June 2006
Discussions on Further Advancing Operational Risk Management (1)――― Summary of Discussions of the "Study Group on the Advancement of
Operational Risk Management"
I. Introduction
In November 2005, the Study Group on the Advancement of Operational Risk
Management (hereinafter the Group) began discussions among experienced
practitioners of operational risk management to consider various approaches
necessary for advancing operational risk management. (See Appendix for members'
list.) The Group has taken into consideration discussions abroad and approaches
actually adopted by foreign banks with advanced operational risk management
expertise (especially pertaining to risk quantification). The Center for Advanced
Financial Technology of the Bank of Japan's Financial Systems and Bank
Examination Department serves as the Group's Secretariat.
This paper presents the highlights of the discussions at the five sessions held throughMarch 2006.1The Group aims to widely disclose its discussions to financial circles
in Japan so that each financial institution may refer to them in advancing operational
management. This paper is mainly written for financial institutions that aim toestablish and strengthen risk management in line with top international practices.
Information on discussions at the sixth and subsequent sessions is due to be
published in the future.
This paper does not intend to draw conclusions for each of the issues discussed. It
simply aims at presenting issues and discussions concerning the advancement ofoperational risk management. Opinions here are those of members and do notnecessarily represent those of the organization each member belongs to.
II. Discussions at the Second Session (held on December 22, 2005)
A. Selecting the type of distribution for risk quantification
1. Potential Issues
Typically, operational risk (in a broad sense) is quantified by the Loss Distribution
1

At the first session (held on November 29, 2005), members confirmed the Group’s management policy
and issues for discussion. Actual discussions started from the second session.

1

Approach (LDA)2 ─ where the loss frequency distribution indicating the number ofloss events during a set predetermined period and the loss severity distribution
indicating the loss amount per loss event together lead to estimates of the type of
distribution of the cumulative annual loss amount.
The Poisson distribution is often used for loss frequency distribution in LDA. In
practice, however, there is no convergence towards a de facto practical standard
approach in connection with the types of distribution for loss amounts. Likewise,
there is no convergence in practice toward a de facto practical standard approach inconnection with the methods for estimating (or validating) parameters for types of
distribution.
Since risk amounts may vary considerably depending on the types of distribution
selected and the methods used for estimating parameters, their selection is an
important issue. The fact that there is nevertheless no convergence toward a de facto
practical standard approach can probably be attributed to the following
circumstances.
(1) There are two categories of operational risk-related losses ─ risk events at thequality of process level (high frequency low severity losses) and tail events that do
not occur often (low frequency high severity losses) ─ and it is difficult to selectdistribution types that can identify them both accurately.
(2) There is a possibility that the loss data sets held by financial institutions are notsufficient in that they do not necessarily represent the actual risk profile from such
viewpoints as number and diversity of samples3, and observation periods.
2. Participants’ Views
When selecting the type of distribution, whether it fits the loss data well is an
important deciding factor, but that is not the only one. Given that the loss data held
2

Sometimes, "scenario-based approach" is also used to refer to a quantification method that primarily uses
scenarios and limits LDA to cases of quantification using only actual historical data (internal and external).
Here, however, the term "loss distribution approach" is used for an approach that estimates loss frequency
and loss severity distributions from data, including scenarios, then combines the two to ascertain the annual
cumulative loss distribution. It should also be noted that "loss distribution approach" is used in a broad sensewhen other approaches are combined with it.
3
For example, even large numbers of samples may be biased towards specific business lines, event types orentities, or there may not be enough data on tail events, which are important for quantification.

2

by financial institutions are normally inadequate in terms of the number of samples
and their diversity, it is important to select the type of distribution after taking such
limitations into consideration.
If, for example, the distribution type that best fits the available data is selected eventhough these data are insufficient, sensitivity of quantification results to data set
could be extremely high (i.e., its stability would be low). In such cases, efforts
should be made to make up for the data's defects by formulating scenario data, etc.,
and models should be adapted to inhibit any instability that defective data may cause
in quantification results. In view of the situation, and bearing in mind that
information on the superiority of individual approaches is currently limited, eachfinancial institution is expected to select the most desirable data supplementation
method and loss distribution type as it carries out sensitivity analyses using different
data samples and different types of loss distribution.
Moreover, in light of the insufficiencies of the loss data sets held by financial
institutions, one of the following approaches is necessary when quantifying
operational risk.
(1) Select a distribution type that fits after drawing up scenario data to supplement
data sets4.
── The conditions that should be considered when drawing up scenarios arehighly dependent on the quantification method adopted. To make sure thatchoices are objective and persuasive to external observers, therefore, it isimportant to: (i) identify an image of the scenario data necessary forquantification; (ii) make comparisons with external data; and (iii) ensure acertain degree of comprehensiveness. With regard to (i), it is possible toconsider a priori settings for various frequency and severity distributions
associated with the overall data, as well as information on the probability of
individual events collected from front-line sections and external sources, andto use them in identifying the conditions that the scenario data must satisfy.
(2)Estimate the parameters of the distributions to fit the data set after specifying loss
frequency distribution and loss severity distribution using a priori information.
4

Please refer to "Discussions at the Fourth Session" for views concerning the preparation and the use of
scenario data.

3

An analysis of practices at financial institutions shows a notable preference forapproach (1) "Select a distribution type that fits after drawing up scenario data to
supplement data sets." This is probably because they are conscious of two points. (i)With approach (2) "Estimate the distribution type parameters to fit the data set after
specifying loss frequency distribution and loss amount distribution using a priori
information," it is difficult to present management with persuasive arguments
concerning the relationship between the selection of distribution type and risk
quantification results, or changes in these results. (ii) On the other hand, the fact that
scenarios are drawn up in cooperation with front-line sections in the case of
approach (1), and that their results are reflected in risk quantification facilitates theirapplication to internal controls.
Whether the management can understand the risk quantification methods easily or
not is also an important point when selecting them. Although the management board
members should be able to grasp the characteristics of models, they are notnecessarily required to understand the contents of these models in detail5.
One possible way of confirming the source of problems concerning risk
quantification methods is to compare these results with risk amounts calculatedusing BIA (Basic Indicator Approach)/TSA (The Standardized Approach). In theongoing process of change in risk profiles and the gross income of banks on which
BIA/TSA are based, however, it should be well understood that it may become very
difficult to interpret these comparative results.
III. Discussions at the Third Session (held on January 26, 2006)
A. How to think about “risk class” and dependency among the units whenquantifying risk
1. Potential Issues
Compared with market risk, credit risk and other types of risk, operational risk
comprises a diversity of risk factors. It is necessary to adopt numerous assumptions
when quantifying operational risk, including types of distribution for loss frequency
and loss severity, and independence between loss events. However, operational risk
is not easy to quantify under common premises because it comprises a diversity of
5This point is discussed on a later date in the session on "Internal controls concerning operational risk, andtheir application in management."4risk factors. Operational risk events should therefore be classified into groups(herein referred to as "risk class") so that individual groups can then be quantified
using common premises for each group.
An analysis of the criteria used in practice by major Japanese and overseas financial
institutions for classifying these risk classes shows that they vary, and there is in fact
not enough convergence yet toward a de facto practical standard approach. Units areclassified by event type, by business line, by event type and business line, by causeof loss, and by legal entity, and in some cases all data are treated as a whole.
Risk class settings and the question of how to establish dependencies6 between theset risk classes have a major impact on risk quantification results. For example, if
the results of quantifications of individual risk class are simply added together, theaggregated risk amounts tend to increase, the more subdivided the risk classes get.
In general, on the other hand, the more subdivided the risk classes get, the easier it
becomes to fit certain prerequisites. However, the number of data in each risk classdecreases and it becomes difficult to perform highly reliable risk quantification
estimates without somehow supplementing the data (there is also the possibility thatrobustness vis-à-vis additional data inputs will be weakened).
When estimating dependencies between risk classes, it is necessary to take into
consideration the possibility that the degree of dependency may differ considerablyaccording to the loss amount, for example (specifically, this refers to cases where thedependency in the tail is extremely high even though the dependency in the
distribution body is small). In other words, there may be cases where it isinappropriate to use figures (such as correlation coefficients) that show
dependencies that flatten overall distribution in order to estimate risk amounts with ahigh confidence level of 99.9%.
2. Participants’ Views
a. Setting risk classes
The following points are kept in mind when setting risk classes for quantification
using the standard LDA.
6

Here, "dependencies" is used to refer to the relationships of risk amounts, loss frequencies and loss
amounts between risk classes. In general, the term "correlations" is frequently used, but this paper has
adopted the term "dependencies" in order to avoid any confusion with the narrowly-defined dependencies
indicated by coefficients of correlation.

5(1) Use a single model to handle data within the same risk class (characteristics andcauses of losses are common, and identically distributed).
(2) Data bundled in the same risk class are mutually independent.
(3) Secure ample data volumes within a single risk class(4) It is useful for internal control purposes (for example, consistency between risk
classes and actual risk management units)
An analysis of actual practice at financial institutions shows that (3) the number ofdata and (4) the internal control considerations referred to above are important
determinants. Since the absolute number of data is small, there are institutions that
adopt classifications based on one criterion instead of the two criteria of event typeand business line (matrix classification). A conspicuous number of institutions use
event types instead of business lines as their criterion for classifications. This
reflects a number of circumstances such that (i) The business lines typically seen in
the West do not necessarily match practices at Japanese banks, (ii) Even if businesslines are selected in line with practices at Japanese banks, handling dependencies isdifficult as like the case of aggregation of losses for multiple sections, (iii)Classifications based on type of event have an affinity with conventional operationalrisk management (cross-functional management encompassing risk related tomanual operations, IT risk and compliance), and (iv) The fact that while thedifferences between risk profiles based on type of event are large, those between risk
profiles based on business line are small.
Although standard approaches to classification methods have not yet converged towithin a certain range, it is important to be able to explain in quantitative or
qualitative terms that the possibility of underestimating the results of risk
quantifications due to adopting specific classifications is small, or that loss data
bundled in the same risk class have the same characteristics7.
b. Handling dependencies
For the risk quantification purpose, dependencies are often considered (i) whenclassifying individual data, and (ii) when aggregating quantified risk amounts ofeach unit. It is notable when analyzing practices at financial institutions to find that7

It should be noted that Basel II prescribes classifications according to a matrix based on event type andbusiness line for numerical reports to the authorities (although the same classifications are not required forrisk quantification <i.e. regulatory capital and economic capital>).

6while the responses of (i) tend to adopt methods that lump together mutually related
loss data event, those of (ii) tend to adopt methods that seek to ascertain the overallrisk amount for the bank by simply adding risk amounts for each risk class.
While it can generally be assumed that risk amounts obtained by simply adding risk
amounts for each risk class may exceed the results of quantifications that lump risk
classes together without classifying them, it can also be assumed that on occasions
the opposite may occur (the so-called "breakdown of subadditivity8"). For thisreason, it is considered important to perform tests comparing the simple total for the
results of quantifications of individual risk classes with the results of quantificationsof all risk classes lumped together.
IV. Discussions at the Fourth Session (held on February 23, 2006)
A. Using scenario data pertaining to risk quantification
1. Potential Issues
Using scenario data is one possible approach to supplementing internal loss data
(especially low frequency high severity losses) when quantifying operational risk.
Preparing scenario data makes it easier to incorporate information pertaining to risk
profiles as recognized by the front line sections even though losses have yet tomaterialize, and is useful in risk analysis and overall management.
When internal loss data supplemented by scenario data are introduced into models
when quantifying operational risk, the scenario data determine the majority of therisk amount if much of the low frequency high severity losses are dependent on
them. In other words, the risk amount changes considerably according to thescenario data setting, so the extent to which objectivity and persuasiveness to
outside observers can be incorporated into the scenario generation process isextremely important.
In connection with the above, the following conditions are likely to become points at
issue but there is not as yet enough convergence within the industry concerning
related approaches and methodologies.

8

When the overall risk amount (in this paper, the overall amount of operational risk for financial
institutions) falls below the total of individual risk (in this paper, the operational risk for individual risk
classes), said risk amount is said to "satisfy the axiom of subadditivity." The term "breakdown ofsubadditivity" used here refers to the situation where this relationship does not hold.

7

(1) Information assumed by ── Overview of the emerging risk events that
scenarios
bring losses── Loss amounts
── Frequency of events── Dependencies between events── Whether the relationship of loss amounts andfrequency of events is estimated as deterministic,or as stochastic as like probability distribution(2) Sensitivity analysis
── Consider the sensitivity of the results of risk
quantifications against the information assumed
above in the scenario formulation process(3) Basis for scenarios and ── Corroborate using objective external data
ensuring objectivity── Corroborate using models that structure
causality── Compare and contrast with standard method in
the industry── Consensus views shared within theorganization(4) Comprehensiveness── Comprehensiveness of the scenario data fromthe viewpoint of both the management andfront-line sections(5) Use in risk management ── Methods to ensure that the scenario
formulation process and the results of scenario
analyses are reflected in improvements in front-line
risk management
2. Participants’ Views
When formulating scenario data, it is necessary to keep in mind the points below
when: a. determining the scope necessary for the purposes of scenario analysis andscenario formulation, and drawing up scenarios from the managerial viewpoint(top-down approach); b. drawing up scenarios from the business lines’ viewpoints(bottom-up approach); c. verifying scenarios; and d. applying in management.
a. Determining the scope necessary for the purposes of scenario analysis andscenario formulation, and drawing up scenarios from the managerial viewpoint8

(top-down approach)
Scenario analyses have two objectives. The first is to supplement the low frequency
high severity loss data that allows appropriate assessments of risk amounts in the tail.
The second is to obtain a forward-looking grasp of the risk situation and reflect the
profile thus identified in the data.
In line with these objectives, it is necessary to specify the necessary scope for
scenario formulation (the overall image of the number of items and the scope forboth the amount axis and the frequency axis) from a top-down viewpoint and, where
necessary, draw up scenarios from a management viewpoint.
(1) Appropriate assessments of risk amounts in the tailIn order to quantify risk for a holding period of one year at a confidence interval of
99.9% with sufficient precision, it is necessary to clarify to some extent
approximately how much scenario data should be prepared (how many data items
covering which frequencies and amounts are necessary) in cases predicated on thequantification model (especially the type of distribution assumed) of the financial
institution in question.
(2) Forward-looking grasp of the risk profile
Even though actual loss events (risk events) may not necessarily have occurred todate, it is important to use scenario data viewed from a top-down perspective toincorporate into front-line risk management any potential loss events that, so far as
one can judge from operational processes, may actually occur with a substantial
degree of probability. In addition to conducting regular scenario analyses, it is also
necessary to carry out continuous reviews using changes in the business andeconomic environments and loss events occurring at one's own or other banks as
triggers.
b. Drawing up scenarios from the business lines’ viewpoints (bottom-up approach)(1) Drawing up scenarios
Separately from the processes of a., banks are required to discuss and identify from abottom-up perspective and to a certain degree of detail the kind of operational risk
they face (the kind of loss events that might occur and the loss amounts andfrequencies involved).
── Examples of loss events include natural disasters such as earthquakes,

9terrorism, embezzlement, misappropriation, remittance errors, the occurrenceof system malfunctions arising from development project failures, anddamages arising from insufficient explanations to customers.
── As for discussion and identification, it is desirable that the risk
management department, etc., or another neutral entity that is independent offront-line operations provides overall coordination, and that front-line sections
get involved in this. From a management viewpoint, it is also desirable toconfirm the comprehensiveness of these activities.
── At such times, it will probably be advantageous to refer to internal andexternal loss data (including mass media reports, etc.), examples of past andrecent operational risk events in Japan and overseas, topical risks such as cash
card counterfeiting, remittance fraud and order issuing mistakes in market
transactions and, to some extent, try to anticipate environmental changes thatcan be expected to occur over the next few years.
(2) Estimating loss severity
One possible way of estimating the loss severity discussed and identified in (1) is tomake determinations while referring to actual transactions in each section (datapertaining to transaction amounts, settlement authority, etc.) and external data.
── Indirect losses and opportunity cost should also be estimated wherever
possible, not just direct losses9.
── The basic approach to losses from earthquakes is to calculate the assumed
amount of damage to tangible assets (based on the damage assumptions of thecentral and local governments, calculate individual loss amounts according to
the earthquake resistance and structures of buildings, etc.). Projections should
also cover indirect expenses (labor costs incurred in repair work, etc.), loss of
income due to operational interruptions, and higher credit costs (deteriorationin the business conditions of borrowers due to damage to their underlying
collateral and the regional economy).
(3) Estimating frequency
Although dependence on expert judgments is unavoidable, reference should also bemade to actual in-house data and external databases concerning loss events in orderto ensure objectivity. Furthermore, in the case where damages arise fromearthquakes, for example, the damage assumptions of the central and local
9This point is discussed on a later date in a session on "Preparing data concerning operational risk."10

governments can also be utilized. In connection with confidence intervals, deeper
analyses of grounds for the frequency assumptions are required in cases where
marginal changes in assumed frequencies can have a major impact on the results ofrisk quantifications (especially in cases where the results of minor changes lead to
substantial increases in risk amounts).
(4) Other
Since it is not always easy for front-line sections to estimate the loss amounts andfrequency of events for scenario data, the following approaches can be considered.
(i) The risk management department can ask the front-line sections to submit
responses in a questionnaire format, and then estimate the loss amounts andfrequency of events from a standardized viewpoint.
(ii) As there is a possibility that front-line sections will submit under- orover-estimates for scenarios if the results of risk calculations affect allocationsof capital or expense budgets to individual sections, the risk management
department should check assumed loss severity and frequency from astandardized viewpoint.
If it is difficult to make one-point estimates (which assume a pair consisting of a loss
severity and a corresponding frequency for a particular scenario) when estimating
loss severities and frequencies for scenario data (or where it is inappropriate becauseof the specifications of the quantification model, etc.), it is possible to estimate"width" (assuming multiple combinations of loss amounts and frequencies forindividual scenarios <or expressing individual scenarios in the form of distribution
type>).
c. Verifying scenarios
It is considered useful to level evaluation criteria (e.g. degree of strictness, degree ofrefinement) for individual sections or operations, and conduct ex post comparative
analyses (verify ex post facto whether actual cases of operational risk occurring after
a scenario analysis were forecast by said scenario analysis, and evaluate thecomprehensiveness and predictive capability of the scenario analysis). The entities
responsible for verification could be either the supervisory divisions in charge ofindividual business lines, or the operational risk control function for the entire bank.
Internal auditors are required to check the verification process itself.

11

Possible methods for enhancing the external persuasiveness, objectivity andcomprehensiveness of scenario data include ascertaining whether the scenario data
set obtained from analysis results, for example, satisfies the requirements of a. above(verifying the adequacy of scenario data). Institutions can consider verifying theadequacy of scenario data by deleting several scenarios from their own risk profiles,
then using their own models to calculate the extent to which risk amounts changed
before and after (sensitivity analyses under rational assumptions).
If the results of the verification show that the requirements are not satisfied, it is tobe hoped that the institution in question will supplement the scenario data so thatthey satisfy the requirements, or review its quantification model (or assumed
distribution type) so that it fits with current scenario data. Additionally, comparisonswith external data or practices of other banks, etc., pertaining to scenarios can also
be considered useful for enhancing external persuasiveness, objectivity andcomprehensiveness.
d. Applying in management
It is also important that appropriate explanations to management of key scenariosthat have a major impact on risk amounts lead to enhanced understanding of the risk
profile and consideration of countermeasures.
V. Discussions at the Fifth Session (held on March 28, 2006)
A. Taking into account operating environmental and internal control factors
associated with risk quantification
1. Potential Issues
When only the internal loss data are used for calculating risk amounts, the very factthat they are historical means that risk amounts do not necessarily reflect the latest
business environment and internal control factors. If the situation affecting thebusiness environment or internal controls has changed recently, therefore, it isnecessary to incorporate these changes into the quantification results in some formor other.
── Depending on the quantification method, the effect of anti-recurrence
measures is not necessarily reflected in the risk amount even in cases where
huge amounts of actual historical losses occurred but then measures areformulated to prevent the risk from recurring.

12More specifically, the use of qualitative risk evaluation ratings to adjust risk amounts,
and the linkage of specific Key Risk Indicators (KRI) with risk amounts can beconsidered in addition to the use of scenario data (including the exclusion andscaling of specific internal loss data). Qualitative risk evaluation methods include
Control Self Assessments (CSA), evaluations by the risk control function,
evaluations by the internal auditor, and adjustments in accordance with managerial
judgments.
However, there remains to be seen enough convergence, even within the industry, as
to the precise definitions of "business environment" and "internal control factors" asreferred to in this paper, or the types of measures that should be used to reflect themin risk amounts, and it is difficult to ensure the objectivity of the methods
themselves.
It is also hoped that using such methods will strengthen the incentive to reduce risk
amounts by reflecting the results of risk reduction efforts by individual sections.
However, given that there has not been enough convergence toward defining
business environment or internal control factors, or reflecting them in risk amounts,
strong front line opposition to incorporating them directly into an incentive system
might be expected.
2. Participants’ Views
In the case where business environment and internal control factors are factored in,
it is important for the scenario to accurately reflect the most recent situation
affecting banking operations. From this viewpoint, the scenario data must satisfy theconditions that have been discussed, in particular incorporating informationsuggestive of recent changes in the business environment and/or the results ofinternal evaluations of the risk management situation.
── As it is sometimes difficult to anticipate revisions of regulations, etc., it issufficient to factor them into scenarios when the probability of such revisions
has increased.
In cases where risk amounts are revised using qualitative evaluations pertaining to
the risk management situation, approaches such as the following should beconsidered in order to enhance objectivity and persuasiveness.

13

(1) In light of the limitations on the objectivity of qualitative evaluations, establish
limits to the extent of revisions in advance in order to avoid huge short-term changes
in capital requirements (e.g. limit revisions to x% of upper and lower ceiling).
(2) Carry out ex post facto verifications of the relationship between qualitative
ratings and actual risk events, and between the results of risk amount revisions andactual risk events.
(3) Conduct organization-wide studies of qualitative evaluations, and approve them.
As with scenarios, it is important to find out whether evaluation levels do not differ
from section to section or from operation to operation, whether the operational risk
control function or the internal auditors check the results of evaluations of eachsection, and whether management approvals are obtained.
(4) Finally, in cases where it is later discovered that, as a result of nonfeasance or
negligence on the part of individual section managers, the results of risk
countermeasures are overestimated or risk profiles (or changes therein) are
underestimated, it is important to create performance evaluation schemes that may
impact the responsibilities of managers in business sections. Possible examples
include: the case in a. where an internal audit highlights heightened risk for the firsttime; and the case in b: where the manager of the section in question may be subject
to penalties because he did not carry out appropriate evaluations based on the"hoped-for" duties of care, and failed to identify the risk in question until theaccident actually occurred. On the other hand, it is also important to continue
creating a “corporate culture” whereby the front line takes the initiative in curtailingrisk, while at the same time remaining aware that explicit incentive systems always
have their limitations.
Apart from risk amount adjustment methods that use the above-mentioned
qualitative evaluations, there are also methods for estimating risk amount byverifying the risk management situation using CSA, etc., and reflecting this in
scenario data frequencies and severities.
Even if measures are adopted to prevent the recurrence of operational risk events
following a huge loss but the model's enlarged quantification results are allowed tostand as they are, the question emerges of how to factor the recurrence14

countermeasures into risk quantification and sectional allocations of quantification
results. Various approaches can be considered for this, including: (i) not using theloss data associated with the causal event in quantifications (deleting it from inputs
into the quantification model); (ii) adjusting scenario analyses (adjusting frequency
and loss severity); and (iii) deducting risk equivalent amounts matching the causal
event in question from allocated risk amounts when allocating the results ofquantifications to individual sections. As yet, however, enough convergence has not
yet been reached on a de facto practical standard approach.
In general, KRI is not directly used in adjusting risk quantifications because it isdifficult to uncover risk factors that develop in a common manner when the risk
profiles of individual sections differ. However, some institutions use KRI when
adjusting frequencies and amounts for scenario data.
Another pending issue is the creation of a mechanism that can persuade the frontline to agree to the verification of CSA by the risk control function or internal
auditors, or their use in CSA results evaluations. However, it is important toestablish appropriate checking functions and incentive schemes in order to ensure
more accurate risk evaluations, and necessary to consider mechanisms that enableinternal auditors and operational risk control function to secure these functions bystipulating risk evaluation criteria.
B. Risk amount allocation criteria
1. Potential Issues
The discussion on allocating risk amounts broadly breaks down into two topics: (i)the home-host issue10 and (ii) internal management issues11. At this time, however,the discussion focused on (i) the home-host problem (the current session also
touched on (ii) internal management issues briefly, although a future session isscheduled to discuss it in a section entitled "Internal controls concerning operational
10

In cases where risk amounts for the entire group are quantified while taking into account the risk
diversification effect between entities, and said risk amounts are allocated among individual subsidiaries on
a top-down basis, the problem is how to deal with the possibility that when overseas (host country)
subsidiaries are viewed on a non-consolidated basis, their capital may be underestimated <in particular,cases may arise where the parent bank in the mother country (home country) cannot provide smooth capital
support>.
11
In the same cases with the above but all entities are domestic ones, the risk amounts allocated may differ
from the risk situation recognized by the subsidiaries. The problem in this case is how to deal with thepossibility that the subsidiary in question may find it difficult to proactively manage risk based on thequantified, allocated risk.

15risk and their application in management").
2. Participants’ Views
Risk amounts should be calculated for each section and division in order to utilize
risk quantification results in comparing risk for each section and division, andapplying incentives. However, since data limitations make it difficult to quantify risk
at the organizational unit level with the precision required for internal management,
it is necessary to allocate bundled quantification results to individual sections anddivisions using some kind of indicator.
Risk amount allocation results become particularly problematic in the case where
the regulatory capital of locally incorporated subsidiaries overseas is calculatedusing the allocation method. There are two problems: (i) when risk amounts(factoring in the diversification effect) calculated for the group as a whole aresubject to simple allocation, the capital of the subsidiary taken on its own may beunderestimated; and (ii) it is necessary to devise allocation methods that reflect therisk of individual subsidiaries (the crux of the home-host problem).
Depending on their future overseas strategies, the home-host problem could well
become an important problem for Japanese banks. Within Japan, too, problems canarise in cases where the regulatory capital of regional banks under a bank's umbrella,etc., is calculated using the allocation method because the subsidiary banks may find
it difficult to manage if they do not know how the risk amounts are allocated.
If the allocation method is used by locally incorporated subsidiaries overseas whencalculating regulatory capital adequacy ratios and the risk amount changes, it isdesirable to be able to identify to some extent how much is due to changes in therisk profile of the local subsidiary itself, and how much to the diversification effect.
For further information, contact
Mr. Tsuyoshi Oyama :tsuyoshi.ooyama@boj.or.jp
Mr. Takashi Arai :takashi.arai@boj.or.jp
Mr. Tsuyoshi Nagafuji :tsuyoshi.nagafuji@boj.or.jp
Center for Advanced Financial Technology
Financial Systems and Bank Examination Department

16

Attachment
List of Study Group Members
Mitsubishi-UFJ Financial Group
Corporate Risk Management DivisionCorporate Risk Management DivisionCorporate Risk Management Division
Bank of Tokyo-Mitsubishi UFJ
Corporate Risk Management Division
Mitsubishi UFJ Trust and Banking Corporation
Corporate Risk Management Division

Keisuke Nakagiri

Sumitomo Mitsui Banking Corporation
Operational Risk Management Department
Operational Risk Management Department
Corporate Risk Management Department
Corporate Risk Management Department
Corporate Risk Management Department

Haruo Isowa
Toshio Kanno
Ken'ichi Yamasaki
Hideki Kai
Yoshitaka Ando

Kenji Fujii
Fumiaki Hibi
Shunji Hayashi
Katsutoshi Edamura

Mizuho Financial Group
Risk Management Division
Risk Management Division
Risk Management Division
Risk Management Division
Mizuho Corporate Bank
Risk Management Division
Mizuho Bank
Risk Management Division

Kazuhiro Mizoguchi

Bank of Japan
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Examination of Computer System Risk Section
Center for Advanced Financial Technology

Tsuyoshi Oyama
Takashi Arai
Tsuyoshi Nagafuji
Nobuyasu Obata
Atsutoshi Mori
Tomonori Kimata

Hiroshi Kakunaka
Noboru Yamada
Koji Shiiba
Takuya Mizuno
Jun Matsuda

17Observing members
Financial Services Agency
Planning and Coordination Bureau (Supervisory Bureau)
Planning and Coordination Bureau
Supervisory Bureau
Supervisory Bureau
Supervisory Bureau

18

Shunsuke Shirakawa
Shin'ichiro Shimizu
Yasuhiro Matsuda
Takaaki Kobayashi
Satoshi Morinaga