Effective Credit Risk-Rating Systems

Transcription

1 INTERNAL RISK RATINGS T his 44 The RMA Journal December January 2002 Effective Credit Risk- by Jim Stoker, Tom Garside, and Tom Yu conclusion of a two-part article presents a case study of a regional bank s initiative to upgrade its credit risk management process. T he first part of this article (September 2001) described how an effective credit risk system should be designed and what issues should be resolved for successful implementation. This concluding section presents a detailed case study of the design stage in implementing such a system at SunTrust Banks, Inc. In September 2000, SunTrust began a thorough and methodical redesign of its entire credit riskrating system. Despite its strong reputation as one of the industry leaders in credit quality, the bank decided that the substantial costs associated with initiating an even more effective credit risk system were justified. The improvements would facilitate the implementation of Basel II in 2005 and would strengthen the bank s position at the forefront of the lending industry. Oliver, Wyman & Company (OWC) was asked to assist SunTrust in accelerating the implementation of the new system with minimal disruption to the bank s daily business and ensure that, once in place, the system would be consistent with industry best practices. Though projects of this type can vary in scope and timing, SunTrust s experiences should be helpful to other institutions involved in similar projects. Priorities and Specifications SunTrust s first step was to identify design specifications that would become the risk-rating system s foundation. Because the redesign of a bank-wide credit rating system is always a major undertaking, demanding many internal resources, consensus among the key players was a prerequisite. After discussions throughout the bank that included line managers, credit officers, and senior management, four strategic imperatives were identified for the new ratings system to support: 1. Loan approval. The correct assessment of the level of credit risk is a key component to a successful loan approval system. 2. Loan pricing. A proper differentiation of credit risk is necessary for a competitive loan pricing model, both to fully exploit potential opportunities and to 2001 by RMA. Yu is a senior manager specializing in North American work at Oliver, Wyman & Company (OWC) in New York; Garside is director and head of the firm s Risk Management Practice in London; and Stoker is a senior manager specializing in risk, based in New York. The authors acknowledge the assistance of George Morris, Jim Wiener, and John Stroughair, directors, and John Stewart, senior manager, all at OWC. Oliver, Wyman & Company is a strategy consulting firm dedicated exclusively to the financial services industry. Contact Stoker at jstoker@owc.com; visit OWC s Web site at

2 Figure 1 Design Set objectives Establish master scale Change rating assignment Align policies THREE STAGES OF IMPLEMENTATION SWITCHOVER avoid adverse selection problems in client relationships. 3. Risk-Adjusted Return on Capital (RAROC). Accurate capital management and performance measurement require consistent risk measures across all lines of business (LoB). 4. Portfolio monitoring and control. Effective monitoring and control rely on timely, accurate measurement of credit risk. The challenge was to support these critical applications while moving the bank closer to compliance with anticipated changes in regulatory guidelines. Based on the priorities of SunTrust management and expectations regarding the Basel II regulatory guidelines, OWC identified five key improvements to the current system: 1. Two-dimensional credit ratings independent obligor and facility ratings to increase accuracy and be consistent with Basel II requirements. 2. Additional granularity in the pass obligor ratings a necessary component of certain systems, such as a RAROC model currently in develop- REFINEMENT ment, that use credit risk ratings as an input. 3. Explicit separation of the assignment of risk ratings and the use of the given ratings. In many credit risk-rating systems, such management decisions as reduce risk can influence credit risk ratings by leading people to assign harsh ratings. The new system should assign grades based solely on the risk of the credits. 4. Bankwide consistency in ratings, both within and across LoBs. In the old system, each LoB had its own ratings scale, and it was difficult to compare these ratings. 5. Increased resources and capabilities for data capture and analysis. The proposed requirements of Basel II make this particularly important. A Master Credit Risk Scale for All Credit Exposures Risk-rating systems should measure the credit risk consistently throughout the entire organization. Within LoBs, guidelines should be set to minimize variation across raters. Risk raters should assess objective factors regarding an obligor or facility similarly, and discrepancies in ratings for the same credit should occur only when raters differ in assessing the qualitative, or judgmental, factors. A line officer often assigns better ratings than do credit officers; this may be considered acceptable because of the conservative watchdog nature of Credit versus the aggressive sales-oriented nature of the line. A good risk-rating system, however, should lead to one answer, regardless of who is doing the rating; deviations from this will ultimately lead to problems within the organization. Consistency of ratings across the LoBs (or within the same LoB but across geographies) should also be a goal. A robust risk culture dictates that all bank staff understand credit risk as a common language. Currently, many institutions rating systems fail to support this. It is not uncommon for ratings across LoBs or geographies to be on differing scales, for example, Our 3 rating is more like the 5 rating in that group. This approach dramatically complicates effective risk and capital management. Instead, SunTrust chose to define a common master rating scale to be used across the entire bank. Move to a two-dimensional system. A two-dimensional credit rating system calculates Expected Loss as the product of obligor and facility risk characteristics. The obligor risk is described by the probability that it will default (PD) and the facility risk by the amount of loss given default (LGD). These two elements are 45

3 Figure 2 EXPECTED LOSS (EL) The twodimensional rating helps answer the question: What is the average loss for this credit? separately recorded and used jointly to compute an expected loss (EL) for a credit exposure. A onedimensional credit rating system uses a single rating scale that is based on EL. The single rating is usually assigned A TWO-DIMENSIONAL SYSTEM ALLOWS MORE ACCURACY IN COMPUTING EXPECTED LOSSES LOAN EQUIVALENT EXPOSURE EXPECTED DEFAULT FREQUENCY (EDF) Obligor Expected Annual Rating Default Rate (%) 1.05%,,,,,, % % = x x Figure 3 40% 35% 30% 25% 20% 15% 10% 5% 0% Obligor rating scale answers the question: What is the likelihood of default? LOSS IN THE EVENT OF DEFAULT (LIED) Loss in Event of Default as % Facility Outstanding Rating Principal A 5% E 50% J 90% Facility ratings scale answers the question: How much of what I am owed will I lose if there is a default? Non-Optimal Distribution Risk Rating DISTRIBUTION OF RISK RATINGS 40% 35% 30% 25% 20% 15% 10% 5% 0% taking into consideration characteristics of the obligor, facility, and collateral, but the factors are never explicitly separated. Over and above the need to comply with Basel II, the business benefits of using a two-dimensional system far outweigh its additional complexity. First, a twodimensional system improves consistency among raters. Factors that drive the PD and the LGD can be evaluated more objectively and tested for relevance. Without separate rating scales for PD and LGD, the importance of these two components will differ from rater to rater. Second, the improved understanding of what drives the EL helps feed tactical applications. It can provide the line with guidance on how to change the facility details to get the deal done for example, If I require more collateral, the LGD will be reduced, driving EL down, and I can price the deal where I want. Third, modern credit portfolio model and economic capital applications require PD and LGD to be quantified independently. Increase and optimize the granularity of the ratings scales. There is an optimal number of pass ratings. If there are too many Optimal Distribution Risk Rating 46 The RMA Journal December January 2002

4 Figure 4 Master Obligor Scale pass grades, assigning an obligor rating becomes too time consuming or subjective and cumbersome. If there are too few pass grades, it s not possible to differentiate risk between the obligors satisfactorily. As a rule of thumb, there should be enough risk ratings to reflect instances in which there is a true difference in default risk. In systems that contain a large portion of credits (over 30%) in one rating, there is likely to be either insufficient granularity or an inappropriate segmentation of the obligor scale. Optimizing the granularity in the obligor scale needs to be done with the risk profile of the bank s portfolio in mind. If a bank has a large subprime mortgage portfolio, it will need more granularity in the lower range of the PD scale; otherwise, it will not be able to distinguish the default risks for each segment within the portfolio. A bank with primarily large corporate credits will not need a high level of granularity in the upper range of the PD scale. Thus, while two banks might have the same number of risk ratings, they may have vastly different bucketing of the obligor scale. Master Facility Scale PD Range (Basis Points) LGD Range (%) Risk Risk Grade Min Max Grade Min Max A B C D E F , ,000 10,000 Increase resources and capabilities for data capture and analysis. A risk-rating system can be undermined by insufficient data capture and analysis. Analysis is necessary to design and parameterize the models and, of equal importance, to validate their output. A successful ratings system requires that all users line, credit, and external parties trust its output. As all approaches to assigning ratings are prone to error, it is necessary to continually check and update the models. For such validation, data capture is of central importance. In the best case, the institution maps and retains all the flows of data used in the ratings processes, including ratings migrations. For example, a commercial LoB should retain all the spreading data used during the initial ratings assignment and then record the subsequently assigned ratings as the credit is rerated over its life. At a minimum, all ratings systems require data to recalibrate the systems to the PDs and LGDs experienced for each asset class. Establishing a model management unit is one approach to providing such resources. Changes to How Ratings Are Assigned in the New System A risk rating should be a pure reflection of the risk associated with a particular credit. The rating should be applied without regard to the decisions that will subsequently be taken based on this rating. Two errors are common in this process. The first is the assignment of whatever grade is required to get the deal done, that is, to get approval. This can lead to hidden risk and underpriced loans. The other error is a move by the institution toward conservatism, by grading new deals too harshly. This practice will result in less risk in the portfolio, but lower profitability as well. Though SunTrust showed no consistent bias in either direction, it was agreed that an explicit goal of the system redesign would be to ensure that no such problems could occur in the future. Model development. Given the variety of different business lines at SunTrust, it was impossible to create one standard model to evaluate credit risk. It was necessary to take two broad approaches, differentiating between commercial/corporate credits and consumer/residential mortgage credits. 1. Commercial and corporate. The commercial and corporate LoBs benefited by the existence of broadly successful external models (Moody s RiskCalc TM and KMV s CreditMonitor TM ) used to measure the probability of default. Though the ultimate goal of the project was to develop 47

5 models tailored to the SunTrust experience, current data limitations made this difficult. As a result, it was decided that external models would be used, if possible, as a point of departure. The process of testing and ultimately improving these models was done in a two-stage exercise. First stage. The first stage was to select a sample of credits from the relevant SunTrust portfolio (including credits that had defaulted) and run them through the external models to get the associated PDs. Concurrently, a representative group of internal credit experts was asked to rate these same credit packages using the old SunTrust rating scale, ignoring all facility-related factors and listing what they considered the main drivers for the rating that they assigned. The purpose of the exercise was to: Get a sense of whether the external models were doing a reasonable job of getting the ordinal risk ranking of the packages correct. Try to identify a few obligors where the model and credit experts differed in their risk assessments. These would be the packages used in the second stage of the credit experiment. The first stage of the experiment indicated that the vended models performed adequately as a starting point for assigning a rating; however, the vended model was not usable in any of the portfolios for the assignment of an internal rating without some form of adjustment. In all cases, there were obligors where the rating assigned by the model and the credit experts diverged; these differences could have been due either to an omission of a relevant factor by a lending expert or to the weighting assigned to a factor used by the model. These obligors formed the basis of the second-stage experiment. Second stage. In the second stage, the selected obligors were redistributed to a broader group of credit experts. Included with the packages was the list of factors identified in the first stage of the experiment that were considered possible reasons for the differences. The credit experts then regraded the packages under different assumptions regarding these factors. For example, had a package been downgraded due to problems related to the obligor s industry, the experts were asked to regrade the package under the assumption that the obligor was in a different, more standard industry. By compiling the responses, it was possible to estimate both the factor s potential significance and the consistency, or lack thereof, between the experts when judging the various factors. Several factors were subsequently excluded, because of either low average estimated importance or dramatic variance in the experts measures of the factors importance. The remaining factors formed the basis for developing templates for judgmental overrides. These structured overrides allow a loan officer to upgrade or downgrade a given credit by a limited amount for a variety of well-defined criteria, such as management quality and industry type, ensuring that the experience and expertise of the credit raters were not lost. The last step, currently under way at SunTrust, is the writing of policy governing ratings assignment, with particular attention to the rules and procedures governing judgmental override authority. Due to the lack of reliable external data, the templates used to determine LGD had to be developed wholly in-house. Template development involved in-depth discussions with SunTrust s staff across all lending operations, including line, credit, and recovery. The systems are now being put in place that will capture the data needed to validate and fine-tune the templates. 2. Consumer and residential mortgage. For the obligor models of the consumer LoB, the ultimate goal was to create scorecards that can use relevant customer data (for example, FICO scores, payment history, seasoning, and vintage) to predict defaults. In fact, throughout SunTrust, a variety of different customized scorecards have and are being used. In the interest of standardizing the credit-rating process, however, it was decided to create an initial scorecard that was simple enough to be used throughout SunTrust s retail operations. For the first time, this scorecard, in effect, standardized the credit process enterprisewide. Such scorecards rely heavily on bureau scores and collateral types and are being implemented so that they can be readily upgraded as new data becomes available. The initial estimates for these scorecards were developed using a combination of internal SunTrust data and industry 48 The RMA Journal December January 2002

6 benchmarks. A similar process was used to develop the LGD estimates. Restricted data availability made it impossible to rely solely on internal collections data. Consequently, for each of the consumer products, internal data was the basis for one part of the process; as necessary, the data was supplemented by the judgment of internal credit experts and industry benchmarks. Policy Alignment To enable the new ratings to be used effectively and to provide a strong governance framework, SunTrust must align its risk management policies and practices. This requires several areas of change. First, it will be necessary to write a set of procedures to guarantee effective use of the new credit risk ratings. Second, it will be necessary to ensure that the many people who participate in the risk ratings process, including line, credit, and higher levels of management, are fully aware of the ratings process and confident in its use. A final area of concern is in IT systems. To ensure compatibility, SunTrust simultaneously upgraded its IT systems with its credit process. Policies and procedures. To get maximum value out of an improved credit risk-rating system, policies and procedures needed to be put in place to ensure that the ratings system is applied correctly and that the results are used appropriately. Performing this task successfully was central to the SunTrust initiative. By having SunTrust personnel in key roles, the process of understanding both the capabilities and limitations of the new system, as well as how the system can be best applied, was significantly accelerated. Two primary types of policies and procedures were considered: 1. Detail-oriented procedures. The SunTrust experience was absolutely vital for establishing these procedures. For example, a common question in this type of redesign was how to treat loan guarantors. There is no broadly accepted approach to take. In this instance, the SunTrust team leaders took on the chore of simultaneously developing the strategy that was to be used for guarantors, often through extensive polling and discussion groups with the other team members. 2. Best use of the models. This is, of course, a much broader issue, and one that cannot be limited to the time used to develop the models. SunTrust put in place a monthly working group that both oversaw the development of the models and was responsible for their appropriate use. This group is expected to continue meeting for the foreseeable future. Organizational alignment. A critical issue in successfully redesigning a bank-wide risk ratings system is to ensure institutional acceptance. The importance of buy-in cannot be emphasized enough the best system in the world is worthless if it is not trusted. To ensure that all users of the ratings system would be comfortable with it, OWC emphasized early and frequent communication. People from line, credit, and senior management were consulted in the development stage. The risk-ratings initiative involved more than a hundred people, only six of whom were not SunTrust staff. The key participants from SunTrust were the project sponsors, the chief credit policy officer, the senior VP and managing director, the corporate and commercial credit policy manager, who served as project owner, and the credit risk manager, who served as project manager. To minimize coordination problems from the range of participants, key staff from each of the bank s main operating regions were included in the decision-making teams whenever possible. Although this decision slowed down the initiative s pace, it was considered a reasonable investment. The increased time spent at the front end (development) significantly decreased time needed at the back end (rollout and implementation). In addition, a great deal of effort went into ensuring that the opinions of people who would be affected by the models were heard and their opinions built into the system. Given the data constraints, this was doubly important. Beyond facilitating buy-in, it was also OWC s main window into the SunTrust experience and made tailoring the models to SunTrust much easier. Installation of model management. A process was required to test credit risk models for accuracy and improve them over time. 49

7 Two options were identified: 1. Allow all lines of business to verify and adapt their models as data became available. 2. Standardize this process in one Model Management unit, whose members would be responsible for validating, calibrating, and broadly improving all of the models developed for credit rating. By electing to establish a centralized Model Management unit, SunTrust also ensured that the bank was kept up-to-date on all new approaches to credit risk measurement. Consistency throughout the various lines further ensured accuracy and minimized the chance that specific LoBs would lose faith in the process. In addition, the centralized Model Management unit would make it easier to keep current with the rapidly changing world of credit risk management. IT alignment. Concurrent with improving its credit risk-ratings system, SunTrust is involved in updating its IT systems. This added to the complexity of the project, particularly with respect to data analysis and capture. To meet management objectives, IT systems were tailored to work as seamlessly as possible with the rating models. Data limitations. At the heart of any credit risk-ratings system designed to comply with future Basel II requirements is a strong history of data collection. Rapid organizational change, however, oftens means that data either is not available or is considered flawed. It was necessary to identify what data was to be tracked without the advantage of basing the decision on extensive data analysis, and this data had to be collected immediately, even if not currently usable. As discussed above, the choice was made to use external models in the commercial and corporate LoBs. The IT update was put in place with this in mind. The models directed the choice of data to be collected, and the subjective override templates would also be tracked. In addition, the LoBs were directed to create lists of additional data that they felt might be included in future upgrades. For the consumer and mortgage LoBs, target models were developed to direct data capture and will be tested when sufficient data is available. Of critical importance was making sure that data collection began as soon as possible, to allow customization to SunTrust s experience as quickly as possible. This effort required compatibility with the bank s concurrent initiative in updating its IT systems. SunTrust wanted to ensure that the systems ultimately put in place would remain sufficient for future needs. By interviewing individuals in the various LoBs, expectations were set regarding model evolution, model updates, and the requisite supporting data needed to meet those expectations. Conclusion The new credit risk-grading system at SunTrust is very much a work in progress. For each of the main LoBs, models are in place that will rate credits based on the SunTrust master obligor and facility scales. However, the key to these models is not that they be perfect (an impossible goal) but that they be sufficiently robust to add value to credit risk management decisions and be designed to readily incorporate the results of enhancements derived from future data capture. It is highly unlikely that the models will not materially change over the next two to four years. This is likely to be true in most LoBs, and a measure of success of the initiative will be how easily this change takes place. Through its initiative, SunTrust is in an excellent position to enhance its position in commercial and corporate lending and to continue adopting best practice advances as they occur. Keep em Covered! Does your Journal circulate? Keep it fresh with a made-to-fit cover. Store a full year of the Journal in a binder that stores easily on a bookshelf. Call to order a single-month cover (#616215) or full-year binder (#616209B). 50 The RMA Journal December January 2002