RBA Annual Conference – 2007 The Evolution of Risk and Risk Management – A Prudential Regulator's Perspective John Laker

1. Introduction

The decade since the Reserve Bank of Australia's 1996 Conference on ‘The Future of the Financial System’ has been a period of remarkable strength for banking systems in advanced industrial countries, particularly Australia. Banking institutions have enjoyed strong growth in business volumes, high asset quality and record profitability and they have proven their resilience in the face of episodic market and other shocks. The period has also been characterised by intensifying competition in banking, which has put margins under sustained downward pressure, and continued innovation, which has altered the complexity of banking activities. The increasing power and sophistication of technology, the growth of electronic commerce and greater use of outsourcing arrangements have led to fundamental changes in the manner in which banking institutions produce and deliver their services and manage their risks.

The current strength of banking systems is attributable, in the main, to the favourable macroeconomic environment and benign credit cycle, particularly over the last few years. In many countries, a greater household appetite for debt in a low-inflation, low-interest-rate world has also been a major driving factor. The policy implications of rising household indebtedness are explored in other papers at this conference.

Another contributing factor, though one that tends to receive less attention, is the improvement that has been taking place in risk management within banking institutions. New technology and instruments aside, one of the most positive developments is that the risk management function in banking institutions is now more clearly identified and resourced, more integrated into their overall operations and generally commands more authority. Global regulatory initiatives such as the new Basel II Capital Framework have been a major catalyst for improvement but the greater sensitivity of boards and senior management to risk issues has also provided critical impetus.

This paper discusses the evolution of risk and risk management in banking over the past decade, from the perspective of a prudential regulator. The Australian Prudential Regulation Authority (APRA) is Australia's integrated prudential regulator of banking institutions, insurance companies and most of the superannuation (pensions) industry. In the banking system, its mandate is to protect the interests of depositors by promoting prudent business behaviour and risk management on the part of individual banking institutions – not to eliminate failures, but to keep their incidence low.

The paper addresses four main themes:

1. the changing nature of risks in banking, particularly in sustained good times;
2. the evolution of risk management;
3. the movement to risk-based prudential supervision; and
4. developments in economic capital modelling.

Naturally, APRA's perspective on these themes is shaped by its coal-face experience with Australian banking institutions but our comments are intended to have wider applicability. In Australia, banking institutions comprise banks, building societies and credit unions, a broad grouping known as authorised deposit-taking institutions (ADIs) but described in this paper as banking institutions for convenience.

2. The Changing Nature of Risks in Banking

The current risk profile of the Australian banking system has been shaped by a number of broad developments:

• sustained balance sheet expansion driven by double-digit growth in housing lending, traditionally a safe asset class;
• the erosion of traditional retail deposit bases because of product innovation and competition for financial assets;
• a consequent diversification of funding sources and financial activities;
• technology-driven efficiencies that have contributed to a pronounced reduction in cost-to-income ratios; and
• a relatively cautious approach to offshore expansion.

Leaving aside the mainly wholesale activities of some foreign-owned banks, the current risk profile of the Australian banking system is, in many respects, a ‘conventional’ risk profile for retail banking institutions.

As part of its risk-rating system, described later in this paper, APRA forms a judgment about the significance of each of the inherent risks facing a supervised institution, according to the contribution of each risk to the overall business profile of the institution. Though not too much should be read into the precision of the weightings themselves, the ranking is interesting. For banking institutions, the highest significance weighting is for credit risk; the weighting is well above that for operational risk and considerably above that for market risk. This ranking is consistent with the weighting of risks in economic and regulatory capital modelling in Australia.

The ranking for credit risk is not surprising. In contrast to overseas counterparts, the larger Australian banks retain the greater part of the credit risks they originate on their balance sheets. Though participants in securitisation markets (mainly for housing loans) and credit derivatives markets (for corporate loans), they do not make substantial use of these markets to divest themselves of credit risk; for the four major banks, the value of assets that have been securitised is less than 2 per cent of the value of assets retained on their balance sheets. However, regional banks and some smaller banking institutions make greater use of securitisation markets, mainly for funding but also for regulatory capital management purposes.

For the larger Australian banks, the originate-to-distribute model is not predominant and the principal-agent problem or agency risk associated with that model is not APRA's main focus in the credit area.^[1] In general terms, agency risk is the risk of loss to a principal from an agent's decision to resolve conflicts of interest in favour of the agent rather than the principal.^[2] APRA has ‘clean sale and separation’ requirements to address agency risk in securitisation by making it clear that the banking institution is not the agent of the investor and the investor cannot rely on the institution for assessing risks on the assets that have been originated. APRA's main focus, however, is how banking institutions manage credit risk on the balance sheet. The exposure of the Australian banking system to the housing market and to highly-geared households has been a particular credit-risk issue for APRA – and a vulnerability identified in the International Monetary Fund's Financial System Stability Assessment of Australia in 2006 (IMF 2006) — but stress testing suggests that banking institutions would be resilient to a significant housing market shock.

The ranking for operational risk is also not surprising. Defined in the Basel II Capital Framework as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events, operational risk is one of the larger risks now facing banking institutions, an obvious consequence of the greater complexity of banking activity and its increasing dependence on technology and specialist skills. From a prudential perspective, the recurrence of small operational problems would not be an issue in a large, complex banking institution; the concern is the unusual individual problem or event that carries potentially large exposure to financial losses or loss of reputation. Two such problems have materialised in the Australian banking system in recent years:

• in 2001, a major Australian bank lost around A$3.0 billion because of errors in the valuation model for the mortgage portfolio held by its United States subsidiary; and
• in 2004, ‘rogue’ foreign currency options trading at that same bank resulted in a loss of A$350 million, an overhaul of the Board and senior management and a considerable dent in reputation.

Two particular sources of operational risk have been growing in importance. The first is outsourcing. As the value chain involved in developing, marketing and managing banking products is analysed and dissected, the outsourcing of some functions within that chain has become more commonplace. Cost pressures and the specialised nature of particular functions, which require large investments to achieve necessary critical mass, have also encouraged banking institutions to turn to external service providers in Australia and, increasingly in recent years, offshore (‘offshoring’). This trend towards greater specialisation in service provision is a global one. Nonetheless, outsourcing gives rise to a number of risks, including counterparty, contractual and business continuity risks, and these risks can be accentuated when the service provider operates from a different country and legal jurisdiction.

The second source is technology risk. Electronic commerce in financial services, particularly internet banking, has revolutionised the provision of banking services in Australia, as elsewhere, but it has also exposed banking institutions to costs and reputational risk from service disruptions, whether accidental or malicious. The recurrence of such incidents, and the failure of large and expensive information technology (IT) developments in some banking institutions, have put pressure on boards and senior management to seek improved IT security and better management of substantial IT projects and, where relevant, IT outsourcing contracts.

The other current risks in the Australian banking system that complete the picture of a ‘conventional’ risk profile are market risk and liquidity risk.

Australia banking institutions are active in financial markets and foreign-owned banks in particular have stepped up their trading in derivative instruments. However, banks carry only small net exposures to market risk from trading activities. The market risk capital charge for the major banks using their internal models has been around 1 per cent of capital over recent years. In the context of the Basel II Capital Framework, APRA will require banks accredited to use the more advanced Basel II approaches to hold specific regulatory capital against interest rate risk in the banking book, based on their internal risk measurement models. APRA's decision reflects the fact that this risk can be a substantial one, it is quantifiable, there is substantial homogeneity in how it is managed among the larger Australian banks and there is evidence of active hedging, if not actual trading, of this risk on banking books.

In view of the significance of this risk, continuing margin pressures and the ease with which the risk can be hedged or traded, interest rate risk on the banking book is likely to be the subject of increasing supervisory focus globally.

The management of liquidity risk by Australian banking institutions has undergone considerable change over the past decade, especially the recourse to a broader range of wholesale funding sources such as offshore debt markets and securitisation. This recourse to wholesale funding reflects the need to fund strong balance sheet growth from sources other than household savings, which have been increasingly directed from traditional deposit products into superannuation and wealth management products. In 2006, offshore liabilities accounted for more than a quarter of total liabilities in the domestic books of Australian banks, a figure that is much higher than in most other banking systems.

The IMF's Financial System Stability Assessment identified the high reliance on wholesale funding as another vulnerability of the Australian banking system. Nonetheless, wholesale funding is now well embedded in funding strategies. It provides greater diversification of funding sources – in terms of investors, regions, currencies, markets and instrument types and tenors. At the same time, it strengthens market discipline on the borrowing institutions by exposing them to a much more sophisticated investor set, particularly offshore investors who may be especially sensitive to country-wide credit concerns.

Australian banking institutions manage liquidity risk through a range of strategies, including setting limits on maturity mismatches, holding high-quality liquid assets above a benchmark level, diversifying liability sources and developing asset-sale strategies. As part of APRA's prudential framework, larger banking institutions also model two scenarios – a ‘going concern’ and a five-day name crisis scenario – to demonstrate that they have adequate liquidity in both situations.

The current risk profile of the Australian banking system would not be complete without recognition of two other, and more subtle, risks to which institutions are exposed, particularly after a period of sustained economic expansion. These are strategic risk and agency risk.

To avoid confusion with operational risk, strategic risk can be defined as external risks to the viability of a banking institution arising from unexpected adverse changes in the business environment with respect to the economy, the political landscape, regulation, technology, social mores and the actions of competitors.^[3] These risks can manifest themselves in the form of lower revenues (reduced demand for products and services), higher costs, or cost inflexibility (inability to reduce fixed costs quickly in line with lower-than-anticipated business volumes).

For Australian banking institutions, perhaps the most significant strategic risk over the past decade has been the erosion of their traditional business of intermediating between depositors and lenders. This has happened in two distinct ways. First, as noted above, the increased attractiveness of superannuation as a savings vehicle has meant that funds that might otherwise have been placed with banks as deposits have been invested in superannuation and wealth management products. Many banking institutions have responded to this strategic risk by investing, substantially in some cases, in wealth management operations. As a consequence, Australian-owned banking groups now account for around 40 per cent of total retail funds under management, a share that has doubled over the past decade; for the five largest banks, income from funds management has grown to around 14 per cent of their total income.

Second, in housing lending particularly, new channels have arisen for bringing lenders and borrowers together, bypassing banking institutions. Unregulated mortgage originators, making use of broker networks, have been very successful in originating, packaging and securitising loans, and distributing the resulting debt securities directly to investors. In response, banking institutions have themselves turned to broker networks to extend their distribution capabilities and, as noted above, some institutions have sought to capitalise on these new channels by moving more to an originate-to-distribute model.

Strategic risk confronts Australian banking institutions in a number of other ways.

For the larger banks, international expansion is a strategic risk issue. Outside more ‘traditional’ markets such as the United Kingdom and New Zealand, Australian banks have been taking a cautious approach to international expansion as they seek to identify sources of competitive advantage in other markets. By not committing large amounts of capital offshore, the near-term risk of misadventure is commensurately small. On the other hand, however, banks may consider that a failure to develop market knowledge and product delivery capabilities offshore may, in rapidly globalising markets, result in an erosion of their competitive position relative to major international banks, even in the Australian market.

For smaller banking institutions, the strategic risk issue is the long-term viability of a business model which has competitive strengths – personalised customer service and low fees – as well as limitations, in the form of high cost structures and difficulties in diversifying income sources and raising external capital. The traditional customer base remains vulnerable to the offer of more extensive electronic banking services typically offered by larger competitors.

For foreign banks seeking to build their presence in retail banking in Australia, the strategic risk is that any short-term gains in market share acquired through aggressive pricing in lending and deposit markets might not be held if this pricing cannot be sustained or is matched by established participants.

Some further comments on agency risk are needed to round out the current risk profile of the Australian banking system. Agency risk in the specific case of originate-to-distribute models was touched on above. A more general form of agency risk arises if the interests of management are not aligned with the interests of shareholders and creditors.

An obvious area of potential agency risk after sustained good economic times is executive compensation. In the Australian banking system, executive compensation arrangements in listed institutions tend to involve a fixed annual salary and share options conditional upon performance. Typically, the option grant is zero if performance, often defined as total shareholder return relative to a benchmark group, is in the bottom half of the benchmark group; from the 50th to the 75th percentile of performance, the grant increases and a cap typically applies around the 75th percentile. The performance period is often five years.

Executive compensation that helps to deliver strong risk-adjusted returns on capital over time and rewards genuine out-performance of competitors does not raise prudential issues of itself. For a prudential regulator, agency risk issues arise if compensation arrangements encourage management to focus on a shorter-term horizon than the long-term approach that would also be in depositors' best interests. Incentives to drive up the share price more rapidly than competitors can tempt management to pursue aggressive growth strategies or to ‘hollow out’ the institution by paring back capital buffers or cutting costs, particularly in middle and back offices where risk management functions reside.

As a prudential regulator, APRA does not involve itself in the details of executive compensation arrangements. These are matters for boards and shareholders. Nonetheless, growth strategies, the size of capital buffers and the resourcing of risk management areas are major elements of APRA's supervision of banking institutions and form crucial inputs into its risk-rating system, discussed below. Moreover, boards of banking institutions seeking accreditation to use the more advanced Basel II approaches must sign off that the performance assessment of, and incentive compensation for, senior executives with profit centre accountability take into account the amount of risk assumed and the management of that risk.

3. Improvements in Risk Management

Generally speaking, the quality of risk management in the Australian banking system has improved substantially. The spur was the substantial losses incurred by a number of banking institutions in the early 1990s recession in Australia, particularly those exposed to the commercial property market. More recently, the development of the Basel II Capital Framework has been an important catalyst. Improvement is evident across all aspects of risk management – its governance, risk management frameworks, risk identification and measurement, and risk modelling.

The governance of risk management in banking institutions, from the board down, is stronger and demonstrates greater accountability. Boards are more active in their oversight of risk issues, consistent with the primacy of their role in determining the institution's risk appetite, approving its risk management strategy and policies, and ensuring that management is monitoring the effectiveness of risk controls. Boards generally now have a risk committee as well as an audit committee and there has been a more pronounced separation of the risk management and audit functions. This has sharpened the independence of risk management and has led to a broad industry concept of ‘three lines of defence’:

• the business unit and relevant line management (first line) – primarily responsible for business unit strategy, performance management and risk control;
• the risk management unit (second line) – sitting outside the business unit, but working with any specialist risk management staff inside the business unit to provide technical support and advice to assist the business unit and senior management with risk identification, management and reporting within an institution-wide framework; and
• the internal and external audit function (third line) – providing independent assurance on the effectiveness of the business unit and the institution-wide risk management and control framework.

Boards have shown willingness to fund projects for longer-term improvement of risk management, to listen to and seek the views of the chief risk officer and risk management staff, to probe senior management about risk issues and to hold senior and line managers accountable for outcomes associated with poor management of risk.

In the credit risk area, boards are moving away from a more traditional role of reviewing major transactions and exceptions, to reviewing credit risk policies and processes and identifying the portfolio effects and desired outcomes of credit risk management. From a very low starting point, operational risk management now receives substantial attention as an integral part of the total risk framework in a banking institution. In the area of traded market risk, more resources have been committed to providing genuine market risk oversight and to updating or rationalising supporting IT systems. Escalation procedures have been strengthened and the culture in traded market risk units is more actively managed.

Generally, the risk management frameworks of banking institutions have become better structured and more comprehensive over the past decade. Institutions are moving to common approaches and terminology across the main risks types and a more careful delineation of risks, especially between credit and operational risk. In the larger institutions, economic capital modelling and capital allocation for performance measurement purposes is more integrated with risk management frameworks. Progress in economic capital modelling is discussed later in this paper.

Operational risk management frameworks are more detailed and more closely integrated with the systematic approach applied to credit and traded market risk. The frameworks now typically involve the assessment of and measurement of high-impact operational risk scenarios, in addition to the more traditional risk control assessments. In outsourcing, it is becoming more common for larger institutions to establish central coordinating units specifically responsible for identifying, establishing, monitoring and managing outsourcing arrangements, so as to ensure desired service levels and expected economies are achieved and any problems adequately dealt with.

For traded market risk, improved governance is interacting more effectively with risk management controls to identify inappropriate or unsanctioned activity. Segregation of duties has been strengthened.

Risk identification and measurement has improved significantly, although data quality issues remain. Stress testing has been an important contributor to this advance.

Credit risk portfolio measurement and management has been strengthened and there are now dedicated credit risk management IT systems (in contrast to risk management requirements being built into accounting or loan origination systems) that provide improved credit management information. This extends to better information on aggregate exposures to individual large customers and exposures to individual industries. However, banking institutions still have some way to go in being able to report quickly on trends in average credit quality, beyond backward-looking information on loan arrears and defaults.

In the area of operational risk, improved measurement of losses has involved the building of loss databases (covering internal and external events) as well as the assessment of operational risk exposures through the application of quantitative methods and high-impact scenario analysis. There has also been substantial growth in the use of risk registers, mitigation strategies and project governance arrangements to better manage operational risks. Accompanying this has been a more systematic approach to IT risk management, which is incorporated into the institution-wide risk profile and managed as a business risk, not just an IT risk.

The upgrading of IT systems in the traded market risk area has strengthened reconciliation procedures, which has led to improved data and risk reporting. Stress testing frameworks are now more comprehensive in this area. In liquidity risk management as well, stress testing frameworks separate to APRA's name-crisis requirements have been developed by a number of banking institutions; other institutions, however, have not given as much thought to the potential events that could trigger a liquidity crisis, the severity and duration of a crisis or the potential impact that market-wide disruptions may have on the institution's liquidity position.

Finally, the larger Australian banking institutions are making much greater use of risk modelling and quantitative approaches to risk management and the allocation of capital, as part of the general evolution of economic capital modelling in Australia.

Credit risk models are more sophisticated, with effective validation and monitoring regimes that contrast with the more theoretical validation techniques of a decade ago. Credit scoring has been introduced for secured as well as unsecured retail lending. Traded market risk modelling has been enhanced to handle more exotic or less liquid products and there has been an increased focus on non-traded market risk modelling. In addition to the Basel II Capital Framework, advancements in quantitative methodologies and the desire of banking institutions for reliable model outputs are factors driving this modelling work.

Operational risk modelling is a significant element of the Basel II Capital Framework for banking institutions using its advanced approaches. Operational risk models and measurement practices are evolving rapidly. Both the industry and APRA recognise, however, that there are significant sources of uncertainty in modelling operational risk, in terms of the data, assumptions and modelling choices. There is also an emerging recognition that scenario analysis will play a significant role in the measurement of capital required for extreme loss events. APRA has been at the forefront, globally, in the development of scenario analysis in this area; it has been working closely with institutions to identify assessment biases in scenario analysis and ensure that business unit participation in extreme loss exercises produces consistent results. APRA also requires the advanced Basel II banking institutions to appropriately identify and assess uncertainty in their operational risk measurement and modelling assumptions and parameters, and measure the capital impact via sensitivity analysis. This approach provides the basis for applying an appropriate degree of conservatism in the calculation of capital requirements.

As models evolve and data accumulate, better model validation should be possible and the degree of uncertainty should reduce. However, it may be some time before the distribution of extreme loss events (which are ‘heavy in the tails’) becomes more certain.

As a general point, the benefits of more extensive use of risk modelling need to be assessed cautiously. Experience confirms that models do not work in all the circumstances to which they are exposed. Examples of misspecification or inapplicability include use of the wrong probability distributions or assuming continuity in markets which prove discontinuous under stress. Complex models may also prove unreliable when used to calculate prices of new and less-well-understood financial instruments, which do not trade in deep markets. In the case of complex models, another caution is that those responsible for risk oversight of the model may not have the necessary understanding of the model's complexities and parameter sensitivities, and may allow the model to run without appropriate checks and balances. For these reasons, model governance and validation are a major focus of the accreditation process for banking institutions wishing to use their internal risk measurement models under the Basel II Capital Framework.

The improvements in risk and risk management over the past decade inevitably draw attention to the issue of data quality. More of the day-to-day operations of banking institutions are becoming automated in some form and these rely heavily on relevant and accurate data. So does the modelling within institutions for risk management and capital allocation. Poor data quality can compromise decision-making, have a detrimental impact on behaviour across an institution and ultimately lead to a failure to meet business objectives.

Against this background, APRA has begun consultations with banking institutions on developing data management requirements. APRA envisages that a banking institution would identify, assess and manage data quality as part of its overall risk management framework, and would have a risk assessment process to determine how critical data are to its operations. A good, well-documented data management framework would include a description of the data architecture, data controls, data validation, appropriate IT environment controls and independent review of data quality and key processes and controls.

4. The Movement to Risk-based Prudential Supervision

Over the past decade, the increasing sophistication of risk management in Australian banking institutions has influenced, and has in turn been reinforced by, a strengthening in the framework of prudential regulation. This has involved a move to more ‘principles-based’ regulation and the development of a risk-based approach to the supervision of individual institutions. Similar changes have been underway in the United Kingdom and other advanced industrial countries.

A principles-based approach to regulation recognises the complexity and diversity that exists among financial institutions and seeks to avoid one-size-fits-all regulatory requirements. It involves the replacement of detailed prescriptive rules and attention to processes within institutions, with high-level standards focused on outcomes. In the past few years, APRA has augmented the framework of the Basel Capital Accord, which has underpinned capital adequacy requirements for banking institutions, with more principles-based prudential standards dealing with governance, ‘fit and proper persons’, outsourcing and business continuity management. These standards (harmonised across the insurance sector as well) have been aimed at enhancing the calibre and decision-making processes of those charged with running supervised institutions and strengthening the ways in which institutions identify and manage their risks.

Risk-based supervision aims to ensure that supervisory attention and resources are targeted at institutions whose activities are posing greater risks or have larger systemic impact. Although the distinction can be overdrawn, the approach contrasts with traditional rules-based approaches that focus on compliance with legislative and regulatory requirements and, in particular, on verifying asset quality and provisioning.

The centrepiece of APRA's risk-based supervision is a robust system for identifying and assessing emerging risks in a supervised institution, and for deploying APRA's resources. The risk assessment model, known as the Probability and Impact Rating System (PAIRS), involves a joint assessment of the likelihood that an institution will fail to honour its financial promises (probability rating) and the impact that the failure of the institution would have on the financial system (impact rating).

Probability ratings are determined through a structured framework in which supervisory judgments about an institution – based on on-site and off-site supervision, statistical returns, communications with boards and management, audit reports and other information sources – are formally weighted and scored. This framework has three building blocks: the inherent risks facing the institution arising from the types of products and services it offers, its strategies and risk appetite; the effectiveness of management and controls in mitigating these risks; and the extent of capital support to meet unexpected losses. The elements that comprise each of the building blocks are weighted according to their significance to the overall risk profile of the institution and then scored on a scale ranging from zero to four (with higher scores indicating an increased likelihood of failure).

The PAIRS model takes the weightings and risk scores to produce an estimate of the ‘overall risk of failure’. This is the PAIRS probability rating – the likelihood that unexpected losses resulting from the institution's net risk exposures would exceed its capital resources, leading it to fail. In producing this estimate, the relationship between the individual building blocks and the overall risk of failure is not assumed to be linear. The experience of major credit rating agencies is that the relationship between ratings and the observed default rate is exponential. In the PAIRS model, as the risk scores deteriorate, the overall risk of failure rises significantly. Hence, any weakening in an institution's risk profile is strongly signalled to supervisors.

The determination of probability ratings in this way has been described as a form of ‘meta-regulation’, in which the regulator relies on, and reviews, an institution's own system of accountabilities and controls (Black 2004). A number of mechanisms, including benchmarking against similar institutions and comparisons with external credit ratings, are used to ensure that PAIRS probability ratings are as accurate and consistent as possible. As Figure 1 shows, APRA's PAIRS ratings are centred very close to external ratings but tend to be a little more conservative.^[4] This is not surprising. Ratings agencies include in their assessment a judgment about the likelihood that APRA will intervene effectively should an institution find itself in difficulty; the PAIRS ratings, on the other hand, make no pre-judgment about APRA intervention. All cases where PAIRS ratings vary substantially from external ratings are closely reviewed.

The impact rating is an assessment of the potential adverse consequences that could ensue from the failure of a supervised institution. At this point, APRA relies on a single scalar – total resident Australian assets – to determine impact ratings (subject to management override in exceptional cases). This provides a workable measure for the direct impact of failure; however, it does not capture any indirect effects on the industry or more systemic effects on the broader economy. This is an area for further research.

Under APRA's Supervisory Oversight and Response System (SOARS), the probability and impact ratings of an institution are combined (with equal weightings) to determine APRA's supervisory response. Where PAIRS involves substantial calculations and judgment, SOARS is simply an overlay of supervisory stances, designed with the aim of minimising the risk of regulatory forbearance.^[5] There are four supervisory stances of increasing intensity, from routine supervision for ‘Normal’ institutions through to vigorous supervisory intervention for institutions in the ‘Restructure’ stance, which are in need of new capital, management, ownership, or possibly all three. The SOARS grid has been set so that the larger the regulated institution, the earlier and more pro-actively APRA responds to a given risk of failure.

The PAIRS/SOARS model shares a number of features with the risk-rating models used by the Office of the Superintendent of Financial Institutions (OSFI) in Canada and the Financial Services Authority (FSA) in the United Kingdom, and other models.^[6] However, there are differences:

• the use of an impact rating is not universal, but is appropriate for a prudential regulator such as APRA, which supervises a wide range of institutions by size;
• most other models do not separate their risk-ratings and supervisory responses. In the OSFI approach, for example, institutions are assessed (equivalent to a SOARS stance) directly from the risk grid. The FSA approach is similar to OSFI's, except that the FSA combines prudential, behavioural and market conduct responses in the same overarching model; and
• PAIRS produces a probabilistic estimate of the likelihood that a supervised institution will fail. Other regulators provide only a ‘low’/‘medium’/‘high’ risk split, or equivalent, and these qualitative descriptors are not mapped to failure probabilities.

In APRA's view, a risk-based approach has considerably improved the efficiency and effectiveness of APRA's supervisory activities and helped to reinforce standards of risk management in the Australian banking system. Nonetheless, in sustained economic good times, the discriminatory power of a risk assessment model may not be easy to assess. As one performance measure, APRA has developed ‘transition matrices’ to track the migration of institutions between the different supervisory stances. Over the past four years, the great majority of institutions (in banking as well as other regulated industries) in ‘mandated improvement’ or ‘restructure’ at some point have either improved or exited the industry, with only one small failure as such (in superannuation). Of the 176 institutions that have been in these two stances, 55 have improved, 24 remain in their SOARS categories, 1 has been downgraded and 95 have exited (Table 1).

Table 1: Entities in Mandated Improvement or Restructure

2003–07

Current stance	Mandated improvement	Restructure	Total
Normal	14	3	17
Oversight	37	1	38
Mandated improvement	16	0	16
Restructure	1	8	9
Exit	68	27	95
Failure	1	0	1
Total	137	39	176

Before leaving this section, it is worth asking whether the more flexible, risk-based approaches to prudential supervision being pursued by APRA and counterparts overseas are compatible with the new Basel II Capital Framework.

Use of the standardised Basel II approaches raises no particular issues. These simply add greater granularity to capital requirements and allow banking institutions to utilise external ratings, where available. On the other hand, the very detailed rules associated with the more advanced Basel II approaches to credit, market and operational risk might suggest that a return to a rules-based approach to supervision is unavoidable.

The answer lies in understanding what Basel II's detailed rules are seeking to achieve. The more advanced Basel II approaches allow banking institutions to factor their own risk estimates into their capital requirements. The detailed rules serve to ensure that those estimates are robust; that they are not simply based on recent experience or the good part of the economic and business cycles; that they are subject to independent validation; and that they are surrounded by a sound governance process. From a supervisor's perspective, robust risk estimates enable a sharper focus on material risks and a more prompt reaction as risks change.

However, it is the supervisory review process of Pillar 2 that is most clearly aligned with a risk-based approach to supervision. The stated aims of Pillar 2 are to ensure that banking institutions have adequate capital to support all the risks in their business and to encourage these institutions to develop and use better techniques to monitor and manage their risks. In APRA's view, Pillar 2 will clearly support its risk-based approach to supervision, ensuring that supervisory resources are focused on emerging risk issues while minimising supervisory intervention into well-run banking institutions.

5. Developments in Economic Capital Modelling

The improvements in risk management over the past decade, particularly in larger Australian banking institutions, have been crucial formative steps in the evolution of economic capital modelling in Australia. The advanced Basel II approaches have sought to capture and add impetus to such developments globally.

Economic capital for a banking institution can be thought of as the maximum amount of unexpected losses potentially arising from all sources that could be absorbed while remaining solvent, with a given level of confidence over a given time horizon. It contrasts with regulatory capital, which can be thought of as the maximum amount of unexpected losses that could be absorbed without any loss to depositors, with a given level of confidence over a given time horizon.

In principle, to quantify the amount of economic capital needed to provide the level of confidence chosen, an estimate of the probability distribution of all possible profit and loss outcomes for the banking institution would be required, incorporating the potential unexpected losses from all relevant risks. From this distribution, the institution's board and management could determine the level of equity capital needed to maximise shareholders' wealth over the longer term. Disincentives would be in place to ensure that activities that fail to achieve returns on allocated economic capital in excess of the cost of equity would be avoided; incentives would be in place to ensure that activities that generate returns in excess of the cost of equity would be encouraged. In this ideal world, financial performance measures based on returns on economic capital would pervade all aspects of the institution's risk management, product pricing and performance evaluation and compensation.

The principle that performance should be measured and evaluated against the capital needed to support the risk was introduced some years ago by major global banks for loan pricing and, soon thereafter, for financial market trading activities, with the use of value-at-risk, or VAR, concepts. Return on risk capital, rather than absolute dollar trading profits, became a key input to performance evaluation and reward for traders. Multi-risk economic capital models with coverage beyond credit and market risks were the next stage of development. However, since the initial proposals in 1999, it has been the Basel II Capital Framework that has provided the spur for large, complex and internationally active banks to develop and drive their businesses according to risk-adjusted performance, based on economic capital models.

For the larger Australian banks, the objective of accreditation to use the more advanced Basel II approaches has led to a substantial investment in risk identification, measurement and management, as described in Section 3. This investment is already yielding returns in the form of the higher potential profitability that a better understanding of the risk dynamics of the banking business provides. Nonetheless, the achievement of comprehensive, consistent and accurate measurement of overall risk exposures still appears some way off. There are differences in economic capital modelling methodologies in terms of risk coverage, risk definitions, exposure measurement and risk aggregation. There are also significant differences in the relativities between modelled economic capital numbers and equivalent Pillar 1 regulatory capital estimates. These problems are certainly not unique to Australian banks.

The dimensions of the economic capital modelling task ahead can be illustrated by reference to the Pillar 2 risks that have received less attention than the credit, operational and market risks covered by Pillar 1. Pillar 2 does not seek to provide an exhaustive list of potentially material risks, but it does identify a number of risks, including liquidity risk, strategic risk and reputational risk. The difficulty in treating these risks is related mainly to precise definitions and measurement methodologies; in the case of liquidity risk, however, there is debate about whether it belongs in an economic capital modelling framework at all.

The main argument for excluding liquidity risk implies a simple two-state world: if a banking institution has sufficient liquidity, it does not need capital support but if it lacks sufficient liquidity, no amount of capital support will save it. This ignores a middle ground where the need to generate liquidity unexpectedly to cover a maturity mismatch may involve costs that add to potential unexpected loss, without necessarily triggering insolvency.

There is general acceptance that strategic risk, discussed in Section 2, should be included in any comprehensive economic capital model. Capital is needed to enable a banking institution to ride out temporary changes in market conditions and to allow it sufficient time to adapt its business model to more permanent changes in the competitive environment. However, the absence of sufficient meaningful historical data makes measurement a problem, particularly with regard to the low-probability, high-potential-impact strategic losses that are a major concern to banking institutions. Some blend of subjective stress testing with statistical methods where available data permit might be the best that can be achieved.

Reputational risk may arise by way of group contagion or from the institution's own actions; in the latter case, reputational loss may well be the consequence of another risk event rather than a risk event in its own right. Either way, the potential impact needs to be taken into account in estimating potential overall unexpected loss. In quantifying the impact of a serious operational failure, for example, the cost of the resulting damage to the institution's brand and franchise may far exceed the direct cost of the operational risk event itself. Quantification of potential reputational damage is difficult given the limited historical data available, but the risk is potentially too important to ignore. As with strategic risk, some combination of subjective stress testing with statistical techniques where sufficient data exist would seem to offer most promise.

6. Looking Ahead

Over the past decade, a supportive macroeconomic environment, sustained balance sheet expansion, diversification and continuing improvements in risk management have produced a robust and highly profitable banking system in Australia. Based on traditional indicators, the financial condition of banking institutions, generally speaking, has arguably never been better nor the quality of risk management higher. Risks appear well contained, although the exposure of banking institutions to the residential property market and highly-geared households remains a continuing focus of policy and supervisory attention.

Looking ahead, the challenges for banking institutions and the prudential regulator are to maintain this robust position in the face of uncertainties in the macroeconomic outlook, innovation and growing complexity in financial products and markets, and constant pressure on costs. Three particular challenges can be singled out.

For banking institutions, continuing good times can erode the incentives for boards and senior management to maintain, or where necessary upgrade, investment in and resourcing of risk management functions. In an environment of ever-changing risks, such investment is essential but may not always be easy to defend if share markets are preoccupied with short-term performance that may not take account of risk.

For the prudential regulator, the move to a principles-based approach to prudential requirements brings challenges in establishing appropriate principles and, very importantly, in being able to judge whether a specific solution proposed by an institution is adequate to meet the relevant principle. The approach places particular demands on the skills, experience and judgment of supervisory staff.

Finally, for banking institutions and prudential regulator alike, market expectations of continuing good times will be problematic. The premise of economic capital modelling, and the preferred starting-point for prudential regulation, is that owners of banking institutions will reward management for acting in their long-term best interests by increasing the value of the institution through maximising returns relative to risk. Market myopia and incentive structures that reward growth for growth's sake, or adventurism in new markets or territories, will undermine the best-conceived risk management frameworks in any banking system.

Footnotes

The BIS 2007 Annual Report described the principal-agent problem in securitisations and derivatives in the following terms: ‘What are the implications if originators no longer feel the need for due diligence, and the ultimate buyers do not have the skills or the information required to manage the risks inherent in the complex instruments they are buying?’ (BIS 2007, p 9). [1]

The seminal work in this area is Jensen and Meckling (1976). [2]

For a discussion of this definition, see Allen (2007). [3]

Figure 1 charts the differences between Moody's, Standard & Poor's and KMV ratings, and current PAIRS ratings. The external ratings are translated into equivalent PAIRS rating bands of ‘Low’, ‘Low Medium’, ‘High Medium’, ‘High’ and ‘Extreme’ and then compared to the current PAIRS rating. For example, an entity may have an external rating of ‘Low’ while its current PAIRS rating is ‘Low Medium’; this would indicate that APRA is more conservative by one band. [4]

Information on PAIRS and SOARS can be found on the APRA website at <http://www.apra.gov.au/PAIRS/home.cfm>. [5]

For the OSFI approach, see OSFI(c 1999); for the FSA approach, see FSA (2006). [6]

References

Allen B (2007), ‘The Best-Laid Plans …’, Risk, July, pp 142–143.

BIS (Bank for International Settlements) (2007), 77th Annual Report, BIS, Basel.

Black J (2004), ‘The Development of Risk Based Regulation in Financial Services: Canada, the UK and Australia: A Research Report’, ESRC Centre for Analysis of Risk and Regulation, London School of Economics and Political Science.

FSA (Financial Services Authority) (2006), ‘The FSA's Risk-Assessment Framework’. Available at <http://www.fsa.gov.uk/pubs/policy/bnr_firm-framework.pdf>.

IMF (International Monetary Fund) (2006), ‘Australia: Financial System Stability Assessment’, IMF Country Report No 06/372.

Jensen MC and WH Meckling (1976), ‘Theory of the Firm: Management Behavior, Agency Costs and Ownership Structure’, Journal of Financial Economics, 3(4), pp 305–360.

OSFI (Office of the Superintendent of Financial Institutions) (c 1999), ‘Supervisory Framework: 1999 and Beyond’. Available at <http://www.osfi-bsif.gc.ca/app/DocRepository/1/eng/practices/supervisory/framew_e.pdf>.