William J McDonough: Risk management, supervision and the New Basel
Accord
Remarks by Mr William J McDonough, President and Chief Executive Officer of the Federal Reserve
Bank of New York, at The Bond Market Association: 2003 Legal and Compliance Conference, New
York City, 4 February 2003.
* * *
Thank you, Paul, for your kind introduction. It's a pleasure to be here today, especially since the
important work that compliance and legal officers carry out in their own institutions complements very
well the responsibility financial supervisors have to promote safety and soundness across the entire
financial services sector.
As legal and compliance professionals, the issue you are really addressing is how, and to what extent,
your institution is managing risk. To outsiders, this process can appear, superficially, to be formulaic
and rules-based. You and I know, however, that corporate governance depends on more than just a
company's compliance with rules. We are all learning that effective corporate governance emerges
from the business culture that a company nurtures throughout all of its operations. In recent months,
we've witnessed what happens when firms fail to develop the commitment to manage risks
appropriately. Avoiding the corporate debacles of the recent past requires a clear and consistent
message, as well as a transparent pattern of behavior, that must first emerge from the boardroom. It
must then filter down to the executive offices, the front offices, and the back offices.
In a similar vein, the work of financial supervision is moving away from a purely retrospective,
rulesbased approach. This is particularly true in the banking world. Bank supervisors in the United States
and many countries around the world are assessing the safety and soundness of banks based less on
the strength of the balance sheet today, and more on the strength of controls that will safeguard a
bank's financial health tomorrow.
Still, we believe that evaluating the strength of controls is, in itself, not enough. Indeed, the
tremendous competitive spirit and ingenuity of the financial services sector drives rapid innovation in
the goods and services offered. As those offerings evolve, so, too, must the structures evolve that are
intended to control the associated new risks. Against this backdrop of constant evolution and
inventiveness, the job of bank supervisors is certainly not to hinder the responsible pursuit of new
opportunities and profits. Rather, it is our job to encourage banks to ensure that their controls evolve
with their businesses.
The members of the Basel Committee believe that public policy can best support the enhancement of
risk management by building incentives directly into our system of supervision, the foundation of which
consists of regulatory capital rules. Along that line, the Committee is now engaged in an historic effort
to revise the international rules governing the minimum capital levels required of internationally active
banks. In doing so, we have endeavored to ensure that the "New Basel Accord" is not merely another
set of rules, but rather a framework that recognizes the important innovations in risk management that
banks have achieved and encourages continued improvement over time.
In my remarks today, I'd like to share with you some thoughts on how bank supervisors have worked
to embrace and encourage those developments. My remarks will cover three related areas. I'll begin
with thoughts on how enhancements in banks' risk management processes, driven by business
imperatives, have concurrently led supervisors to move to a more process-oriented, risk-focused
approach to supervision. Next, I'll spend a few moments discussing how provisions in the New Basel
Accord - or "Basel II" - support further changes in our supervisory approach, and promote further
enhancements in risk management. Finally, I will describe how these developments will be coming
together in our supervisory approach going forward - particularly in terms of our supervisory
expectations for management of market risk, credit risk, and operational risk by large banking
organizations. While I will offer my views as a former banker and now as a bank supervisor, I believe
that many of the themes offer insight for other sectors of the financial services industry as well.
Complementary effort by Banks and Supervisors to Assess Risk
Let me begin by sharing some thoughts on the efforts banks themselves have undertaken to develop
a more forward-looking approach to risk management. Progress has clearly been made in the
management of market and operational risks, but the advances made in the area of credit risk are, I
think, particularly illustrative. Loan officers and risk managers now have at their disposal an
everexpanding array of software, databases, models, and risk rating systems intended to provide empirical
insight into a risk once not readily quantified. Our examiners have noted growing sophistication in
banks' internal risk rating processes, portfolio management methodologies, and the use of stress
testing. As you know, all of these new tools and processes were developed and refined to promote a
bank's competitiveness and to protect it against loss - and not just to respond to a regulatory mandate.
The resulting benefits to the stability of the financial sector can be seen objectively in the much lower
number of problem banks, and the lower level of problem loans, in the recession that began early last
year, compared to the previous one. For bank supervisors, the industry's own growing emphasis on
enhancing risk management practices has allowed us to shift our approach from evaluating financial
results to understanding and assessing the quality of internal processes. By looking at the strength of
internal controls and the quality of analysis and judgement that management applies, we are better
able to understand how well a bank will weather potential future challenges or business downturns.
In this context, one area that has come under increased scrutiny is how firms manage their
compliance activities across the organization. Firm-wide compliance management is an important
element of good corporate governance and one that can reveal much about a bank's culture and
commitment to managing not only legal and reputational risk, but credit, market and operational risks
as well.
This shift in emphasis should be evident in the examination findings that the U.S. bankers in the room
are receiving. We do not want our examiners to give you back your own numbers, or to limit their
evaluation of your institution to where you stand in terms of some rigid regulatory parameters. Such
information should hardly be news to you. Nor should it be the principal basis on which we assess
your institution.
Rather, our dialogue with you should be focused on our evaluation of the rigor of your control
processes, and particularly on our view of your risk management practices and systems relative to
evolving industry standards. We have the tremendous advantage of breadth of access to firms
engaging in a given business line, allowing us to develop a clear perspective on evolving best
practices. At the New York Fed, we have looked to maximize this advantage by setting up specialized
teams to review specific business lines across the industry in order to develop that informed
perspective. A key goal of our new organizational approach is to enable us to share with you our
specific insights on best practices across a range of institutions.
In the past year or so, I think we have made quite good progress in providing this peer perspective on
risk management and controls. In such areas as corporate governance, economic capital estimation,
and anti-money laundering, I think we have been able to be quite specific on how well a given banking
organization measures up to evolving industry standards - including what needs to be done to move
up to the top rung of performance.
I also recognize that there is a tremendous demand for us to provide even more guidance in these
dimensions. In the numerous feedback sessions we have had with individual institutions on the quality
of our supervisory process, we have heard that message loud and clear. With the maturation of our
organizational approach, I fully expect that we will register further improvements in this dimension.
The New Accord's emphasis on risk management processes
This brings me to my second broad theme - how the New Basel Capital Accord supports further
adjustments in risk management and supervisory approaches and how it fits with the current focus on
corporate governance practices. Since many of you do not hail from banking organizations, I'll take a
moment to summarize the objectives the Basel Committee set for itself in re-writing the international
rules on bank capital adequacy.
The existing rules, which stem from the relatively simple 1988 Basel Accord, represented an important
step in answering the age-old question of how much capital is enough for banks to weather economic
downturns. Widespread acceptance in over 100 countries of the first Basel Accord as the international
"yardstick" has strengthened the capital base and leveled the playing field for banks that compete
internationally.
As you may know, by the late 1990s, it became clear that the original Accord was becoming outdated.
Its broad-brush nature - where required capital generally does not differ by degree of risk - has had a
tendency to discourage certain types of bank lending. It has also tended to encourage transactions
whose sole benefit is regulatory capital relief.
Further, the improvements in risk management tools changed the way that banks monitor and
measure risk in a manner that the 1988 Accord could not anticipate or address. Today it is quite clear
that the original Accord provides internationally active banks, for which it was intended, with less
meaningful measures of the risks they face and of the capital they should hold against them.
To respond to these challenges, the Committee began a few years ago to develop a more flexible and
forward-looking capital adequacy framework - one that better reflects the risks facing banks and
encourages them to make ongoing improvements in their risk assessment capabilities. The Committee
believes that all banks should be subject to a capital adequacy framework comprising minimum capital
requirements, supervisory review, and market discipline. These are the three pillars of the New
Accord. As you may know, the current Accord only has one pillar - minimum capital requirements.
The Committee seeks to align minimum capital requirements more closely with the best industry risk
management practices available. This goal is accomplished by giving banks a range of increasingly
sophisticated options for calculating capital charges. Banks will be expected to employ the capital
adequacy method most appropriate to the sophistication and complexity of their operations and risk
profiles.
For credit risk, the range of options begins with the standardized approach and extends to the internal
ratings-based ("IRB") approach. The standardized approach is similar to the current Accord. Banks will
be expected to allocate capital to their assets based on the risk weights assigned to various
exposures. It improves on the original Accord by weighting those exposures based on each borrower's
external credit risk rating.
Without question, the IRB approach is a major innovation of the New Accord. For the first time, banks
will be permitted to rely on their own assessments of a borrower's credit risk. The close alignment
between the inputs to the regulatory capital calculations and banks' internal risk assessments will
facilitate a more risk-sensitive approach to minimum capital. Changes in a borrower's credit quality will
be directly reflected in the amount of capital held by banks.
How will the New Basel Accord promote better corporate governance and strengthened risk
management practices? Here, I will limit myself to emphasizing two key points.
First, the Basel Committee has expressly designed the New Accord to provide tangible economic
incentives for banks to adopt increasingly sophisticated risk management practices. Banks with better
measures of their economic risks will be able to allocate capital more efficiently and more closely in
line with their actual sensitivity to the underlying risks. By doing so, the Basel II framework encourages
developments in the management of a wide range of risks on a firm-wide basis and developing a more
comprehensive approach to managing those risks together.
Second, to achieve those capital benefits, the more advanced approaches to credit and operational
risk require banks to meet strong process control requirements. Again, the increasing focus on a
bank's control environment gives greater weight to the management disciplines of measuring,
monitoring and controlling risk.
As an example, by relying on banks' own internal credit assessments, the IRB approach builds on the
risk management practices that most internationally active banks are already in the process of
adopting for their internal purposes.
To qualify for the IRB approaches, banks will need to adhere to various specific parameters and
standards that may not be fully in place as yet. Our pilot reviews of U.S. bank readiness do indicate
that there are a number of areas that both banks and supervisors will need to work on to be ready for
full IRB implementation. These include addressing concerns about independence of the rating
process, and accumulating necessary internal default and loss data to be able to produce more
reliable quantitative estimates. Enhancements in these areas will be important, not just to ensure
readiness for IRB, but for further improvement in credit risk management more generally. I expect that
there will be further public supervisory guidance on these and other key elements of the IRB approach
this year.
Operational risk is another area where the Basel Committee is developing a new regulatory capital
approach that seeks to provide incentives for banks to improve their management of risk - - one that is
designed to build on banks' rapidly developing internal assessment techniques, and to accommodate
industry innovation over time. Now that the industry is developing a more refined sense of operational
risk - the risk of losses caused by failures in processes - the New Accord will "unbundle" this risk and
allow banks to differentiate between, and manage separately, their exposures to credit, market, and
operational risks.
As with market and credit risk, supervisors will use a number of qualitative and quantitative criteria to
ensure the integrity of the approaches that banks develop internally - but with the criteria structured to
be flexible enough to allow for a wide range of qualifying approaches. By allowing banks to test and
experiment with a variety of operational risk methodologies and measures, we think that the New
Basel Accord's approach to operational risk will be a true catalyst for innovation.
Timing for the New Accord
As you may know, the revision of the international regulatory capital framework has represented a
monumental commitment on the part of both banks and supervisors worldwide and has been, so far,
nearly four years in the making. Let me now turn to some of the thinking that has already begun
surrounding implementation of the New Accord.
To ensure that our new rules have gotten it right, the Basel Committee has just completed collecting
data for its third Quantitative Impact Study - or "QIS 3" - in conjunction with supervisors around the
world. The industry demonstrated tremendous support for this survey, and 265 banks from nearly 50
countries performed concrete and comprehensive assessments of how the Committee's proposals will
affect them. At this early stage, the results suggest that the incentives built into the New Accord are
functioning as we had hoped. We are completing a detailed study of the results and will ascertain the
need for any adjustments prior to the release of an updated proposal for public comment during the
spring. The Committee intends to finalize the New Capital Accord in the fourth quarter of 2003 such
that it can be implemented in each member country at year-end 2006. During this three-year period,
banks and supervisors are expected to adapt and develop the systems and processes necessary to
conform to the standards of the New Accord.
In that regard, the supervisory agencies represented on the Basel Committee are making good
progress in their preparation for the new framework. To ensure that the New Accord is implemented in
a consistent manner across various jurisdictions, such that market competition is driven by each
bank's strengths, rather than by differences in each country's rules, the Basel Committee established
the Accord Implementation Group. This group is responsible for promoting the consistency and quality
of implementation of the New Accord and facilitating the exchange of information among national
supervisors about bank and supervisory practices. Through the AIG, senior line supervisors - that is,
the people who actually assess banks' risk profiles - are seeking ways for examiners to validate and
supervise internal risk assessment processes in a more consistent fashion across jurisdictions.
Implications of Basel II on the supervisory approach
We've also continued to think about how we should adjust our method of supervision to incorporate
the tenets of the new framework, which brings me to the third and final area that I would like to
address today. Naturally, allowing banks to rely on internal models in determining their capital
requirements has led, and will continue to lead, to changes in our supervisory process. Fortunately, we
have the benefit of some experience already at our side.
In 1996, under the "market risk amendment" to the original Basel Accord, qualifying banks with large
market risk positions were first permitted to incorporate internal estimates of the associated risk in their
regulatory capital requirements. When determining whether a bank may rely on its market risk model
for capital purposes, our examiners have had to evaluate the technical underpinnings of the model, as
well as the risk management and control processes surrounding its implementation and use. They
review such issues as whether the model is based on reasonable assumptions, whether the firm is
making appropriate use of backtesting, and how the model performs under normal and stressed
market conditions. In addition, they are spending significant time on key controls related to the overall
use of models, including the model validation process and the new product approval process.
Likewise, as banks rely increasingly on their own assessments of credit and operational risk when
determining their capital needs, our examiners will have to become well versed in the changing
technical aspects of those models. Some of the conventional, static metrics that we now use - such as
those to judge asset quality and to assess the adequacy of credit loss reserves - are likely to be
supplanted by more quantitative and more sophisticated measures.
As is the case with credit risk, supervisors are in the process of developing a more integrated
framework for assessing the adequacy of banks' operational risk management and measurement
approaches. Our approach focuses heavily on how banks are managing operational risk from a
corporate-wide perspective. As with any aspect of corporate governance, a key element of our
analysis is developing a feeling for the "tone at the top" - that is, the board of directors' and senior
management's commitment to effectively manage its operational risk. Bank examiners will be
assessing whether that commitment translates into an effective operational risk management and
control structure - - including the quality of management reporting and how well operational risk is
integrated into a bank's overall risk management approach.
Our analysis includes banks' assessments of their economic capital requirements for operational risk,
and how this capital is allocated to business lines to reinforce efforts to improve internal controls. With
respect to those specific business lines, we are increasingly looking to drill down to test key controls.
The aim is to ensure that the internal processes in place are in fact working and are effective in
mitigating relevant risks.
Closing Thoughts
Clearly, we are making significant progress in the area of risk management - and our supervision of it.
However, supervision, and risk management, and indeed our notions of what constitutes good
corporate governance cannot be static in this environment. Recent history has proved that some of our
greatest challenges and risks lie in not what we know, but in what we have failed to acknowledge or to
anticipate.
While enhanced risk management can and will lead to better corporate governance through a more
accurate measurement and therefore management of those risks, it must be nimble enough to evolve
to address the challenges that are ahead, wherever they may lie.
Thank you very much.