R Jayamaha: Basel II and operational risk
Keynote address by Dr R Jayamaha, Deputy Governor of the Central Bank of Sri Lanka, at the 10th
SEACEN-FSI Regional Seminar for Bank Supervisors and Regulators, Colombo, 12 December 2005.
* * *
It is indeed an honour to have been invited to deliver the keynote address at this SEACEN - FSI
Regional Seminar for Bank Supervisors and Regulators on the implementation of Basel II and
Operational Risk. I would like to take this opportunity to share some thoughts on this important
subject, which is currently engaging the attention of the Bank regulators, not just in our region, but
worldwide. I will first deal with why Basel II requires a separate capital allocation for operational risk
and what it intends to accomplish. Next, I will discuss how Basel II deals with operational risks and
how it contributes to financial system stability. Finally, I wish to mention a few steps regulators can
take in preparation for adopting Basel II and mitigating operational risk.
2. Deregulation and globalization of financial services, together with the growing sophistication of
financial technology are making the activities of banks and their risk profiles more complex. In this
context, not only well known credit, interest rate and market risks, but also other risks can be
substantial and threaten the stability of a financial system. A growing number of high-profile
operational losses worldwide have led banks and supervisors to increasingly view operational risk as
an integral part of risk management policy. Management of specific, more common or day-to-day
operational risks is not a new practice; it has always been important for banks to prevent fraud,
maintain the integrity of internal controls and reduce errors in data transaction processing, ensuring
the availability of information technology infrastructure and their back up systems when needed. More
often than not, operational risks are taken as given and very little attention has been paid to it.
Operational risk is intrinsic to financial institutions and it should be an important component of their
firm-wide risk management systems. However, operational risk is harder to quantify and model than
market and credit risks. Operational risk differs from other banking risks. It is a risk that is not willfully
incurred in return for an expected reward but is implicit in the ordinary course of banking business and
has the potential to affect the risk management process. However, ignorance of operational risks or
failure to properly manage such risk can result in a misstatement of an institution's risk profile and
expose the institution to significant losses. Such institutions can become a regulatory burden. These
and a few other factors have led the Basel Committee to recommend a separate capital for operational
risk.
3. Definition of operational risk has evolved rapidly over the past few years. First, it was commonly
defined as every type of unquantifiable risk faced by a bank, which has been refined considerably to
include modern day risks. According to the Basel Committee on Banking Supervision, operational risk
is the "risk of loss resulting from inadequate or failed internal processes, people and systems or from
external events". This definition is based on the underlying causes of operational risk at the broadest
level and includes legal risk, but it excludes strategic and reputational risks. The Basel Committee has
also asserted, "the most important types of operational risk involve breakdowns in internal controls and
corporate governance." That's why Basel II aligns with a variety of other regulations and supporting
frameworks for enhancing corporate governance. 'Management of operational risk is thus taken to
mean the 'identification, assessment and / or measurement, monitoring and control of mitigation of this
risk. While many of these risks are inherent and visible in day to day operations of banks, some
components are applicable to supervisors and regulators.
4. The banking industry's awareness of operational risk and efforts to manage it have accelerated in
recent years, driven in part by an increasing desire to improve operating efficiency, reduce earnings
volatility, rationalize the allocation of capital between competing businesses. It is not easy to get
banks to identify and assess the operational risk inherent in all material products, activities, processes
and systems and in particular to follow such practices when new products are introduced. To
encourage banks to focus attention on assessment of operational risk on products and processes,
regulators should be aware of new products, improvements in management information systems and
computing technology that have opened the way for improved operational risk measurement and
management. In the next few years, financial institutions and their regulators will continue to develop
various approaches for operational risk management and capital budgeting techniques.
5. Let me focus on some key areas of operational risks and regulatory responsibility in the
interest of financial system stability.
6. Sound management of operational risk is particularly important in payment, clearing, and settlement
systems as such risks can spread across systemically. All owners and operators of payments,
clearing and settlement systems face operational risks but the degree may vary from system to system
and from country to country. Operational problems in a payment, clearing, and settlement system may
impede the control of, or even exacerbate, other types of risk such as market, liquidity, or credit risk in
an unanticipated way that could pose a systemic risk, resulting in participants incurring significant
losses. It may not stop there. Payment and settlement related operational risks could filter into
businesses of banks' clients, governments and the country's international correspondents as well.
This aspect of banking operations was ignored for many years and it is fairly recently that regulators
and banks started addressing payment and settlement related operational risks. Today's consensus is
that payments, clearing, and settlement systems must be safe, reliable, efficient, and secure, which
are critical to financial system stability. That's why most regulators, the central banks in particular,
have become owners and operators of clearing and settlement systems. Although the tendency is to
outsource this function, many regulators at some stage or other have owned or operated these
systems.
7. Another technology related risk is the desire of banks to acquire the leading edge with propriety
systems, stand alone systems and specific IT systems. Banks tend to hang onto this short-lived
approach. Individual systems are costly not only to banks themselves, but also to customers. The
norms should be not attracting customers, but reducing their operational risks and reduction of
transaction costs to customers. Both are often forgotten or ignored by banks and continuous reminding
has become a regulatory responsibility. Despite moral suasion banks in many countries have not
realized the gains of having common ATM platforms, back-up sites, disaster recovery sites and
sharing of costs.
8. It may also be necessary to for banks to recognize that different risks matter in different lines of
businesses. A comparison of business unit economic capital requirement by risk type indicates that
operational risk is highest in fund management, private banking, and in retail banking when compared
to corporate banking, insurance business (if banks are allowed to engage in). The new operational risk
element is expected to hit banks specializing in areas - such as custodian arrangements and asset
management. The regulators should be mindful of high operational risks in these businesses and
bring them to the attention of banks.
9. Uncertainties, regulatory challenges in promoting banks
In a lighter vein, operational risks can be categorized into two, i.e. man-made risks (mistakes, faulty
models, frauds, terrorism, wars etc.,) and god-made risks (earthquakes, floods, Tsunami disasters,
electrical blackouts, telecom interruptions etc.) Some of these are well known and banks handle them
in their own ways. Complexity of the assessment process and required changes to it, uncertainty in
the implementation date of Basel Accord, the US and some European banks' attitude towards
implementing the Accord, variability in data reporting are a few factors that have created uncertainties
in banks as well as regulators' minds. I believe that these challenges can be overcome if banks can
be encouraged to adopt a systematic approach as set out in Basle II. First and foremost, regulators
have to get banks to commit to a risk mitigation cycle which consists of (a) risk diagnosis (i.e.
prioritization of objectives, documentation review/meetings and building up of a risk control culture
profile); (b) risk identification within a framework; (c) risk assessment and preparation of action plan;
and (d) risk reporting.
10. The choice of the approach/models banks wish to adopt may have significant implications. Score
card, loss distributions and internet modeling are some of the popular risk models. All of them have
implementation challenges, in particular, skills shortage, non-availability of reliable data and suitable IT
systems. In-house training courses tailored to each business unit, commitment by senior
management of banks, understanding of benefits of implementing Basel II by all stakeholders and
hiring of right skills would help in mitigating skills shortage related risks. Regulators and supervisors
have to be at it to assess progress within a reasonable time frame.
11. Without data, there are no models and without models, the risk management capability is reduced.
This does not mean that commonsense approach in handling matters should be discarded altogether.
Given the heavy competition and highly leveraged nature of businesses, banks, at minimum, should
record historical data for computing the probability of default loss, and operational risk losses. This is
a difficult task. The challenge for banks is to build up databases for operational losses, both historical
and potential future losses. The challenge for regulators is to ensure that banks start collecting this
type of data in a systematic manner. Banks often see regulators as a pain in the neck due to constant
nagging. Perhaps, moral suasion and organizing peer pressure might encourage banks.
12. Unbundling risk related capital charges in the new Basel II Capital Accord requires an explicit
capital charge for operational risk. Calculating such a capital charge has proved extremely difficult
because of a lack of an accepted methodology and credible industry data. This has required the
adoption of a strategy to permit banks to use their own internal measurement approaches - subject to
quantitative and qualitative criteria and, on a transitional basis, to a minimum or floor capital charge.
Assessing and validating different internal risk mitigation measures would be a regulatory challenge.
13. The Basel Committee has put forward a framework consisting of three options for calculating
operational risk capital charges in a 'continuum' of increasing sophistication and risk sensitivity. There
are three approaches under Pillar I: (i) the Basic Indicator Approach for Operational Risk I, which
requires a flat rate of 15% or a fixed percentage of gross annual income; (ii) the Standardized
Approach for Operational Risk II which requires a risk charge based on annual income per each
business line, multiplied by a risk factor per business line; and (iii) Advanced Measurement Approach
for Operational Risk III which requires full reliance on bank's internal risk management system subject
to supervisory review. Many Central Banks including the Central Bank of Sri Lanka propose to initially
allow banks to adopt the Basic Indicator Approach for computing regulatory capital for operational risk.
They are expected to move along the range towards more sophisticated approaches as they develop
acceptable operational risk management systems and practices, which meet the prescribed qualifying
criteria. According to DC Independent Survey 2003 and KPMG's 2nd Global Survey on Basel
Readiness Assessment of 190 institutions in 19 countries, increasingly, banks appear to be moving
towards Advanced Measurement Approach rather than Standardized Approach in dealing with
operational risk. As for the Central Bank of Sri Lanka, we have decided to follow a consultative
process while implementing Basel II norms and move in a gradual, sequential and co-coordinated
manner, for which dialogue has already begun with the banks. A steering committee comprising
representatives of banks and supervisors is taking stock of all issues relating to its implementation.
Here too, the regulators need to be on top of things to assess readiness of banks.
14. Conclusion
Let me sum up the key messages of this address. Today, the degree of sophistication in financial
markets urge all market participants, including regulators and supervisors, to increase their focus on
risk management in an effort to build more robust and sound financial systems and to position
themselves to participate more fully in this complex and fast-paced financial environment. In that
sense, Basel II, aiming at further strengthening of the soundness and stability of the international
banking system, offers a unique opportunity to respond to all these concerns and pay attention to the
main sources of risk and vulnerability that could pose challenges for the financial system stability.
15. Implementation of Basel II has been described as a long journey rather than a destination by
itself. The journey is certainly tougher than we thought. Undoubtedly, it would require commitment of
substantial capital and human resources on the part of banks and the supervisors. For banks, the
main challenges appear to be the skills shortages and data inadequacies coupled with uncertainties
regarding costs associated with implementation. Banks all over the world have started to voice
concerns over the mounting regulatory costs. It is a regulatory responsibility to encourage banks to
have a phased implementation programme starting from a traditional baseline scenario of identification
of operational risks, assessment, and awareness monitoring and integrating these elements over a
period. Basle II implementation and operational risk mitigation process puts heavy burden on
supervisors to detect problems in banks, to stay on top of the latest advances in risk management and
to avoid abuses of many powers that are given to supervisors. All these are too much for supervisors
to bear as many of us are still on the learning curve. Exchange of information both within and outside
the region would be very important particularly in capacity building for evaluation and validation of risk
assessment models of banks. This seminar is one such joint effort by the Central Bank of Sri Lanka
and the SEACEN Centre, which would provide a good opportunity to exchange information and learn
from each other.
16. Basel II is expected to foster financial stability through its risk sensitive framework through
encouragement of banks to adopt improved risk management practices. Supervisors and regulators
are required to review the efficiency of banks' risk management practices and capital allocation
methodologies, and empower market participants to make informed judgments on the efficiency of
banks. Despite challenges, many researchers suggest that Basel II leads to rising rewards and
discipline in banking industry. The indicators are that pay back for getting Basel II right and for looking
beyond mere compliance to the real business benefits will be greater than originally anticipated.
Encouraging banks to understand and believe that enhanced economic capital framework would be
the key to high performance is undoubtedly a regulatory challenge.
17. I believe the deliberations of this seminar will improve our knowledge on ways and means of
dealing with regulatory challenges posed by Basel II and operational risk mitigation measures. I wish
the seminar a success and thank you all for your attention.