OF RISK AND CAPITAL FOR BANKS USING ADVANCED SYSTEMS

Transcription

1 ENTERPRISERISK BOARD OVERSIGHT OF RISK AND CAPITAL FOR BANKS USING ADVANCED SYSTEMS Boards can facilitate compliance by exercising oversight of the strategic plan, the wider internal governance structure, and the enterprise risk management process. 72 The RMA Journal December 2014 January 2015

2 BY DEAN A. YOOST Capital requirements, liquidity, and risk mitigation are key priorities for a bank s board of directors. Now, rule changes, combined with regulators minimum standards, have increased these board responsibilities significantly. The Basel II final rule permitted qualifying banks 1 to use an internal ratingsbased (IRB) approach to calculate regulatory credit risk capital requirements, as well as advanced measurement approaches (AMA) to calculate regulatory operational risk capital requirements. Together, the IRB approach and the AMA are referred to as the Advanced Approaches 2 or Advanced Systems. 3 The U.S. Capital Rules issued in July 2013, referred to as the Basel III final rule, brought the Basel II rule forward to create what regulators now refer to as the Standardized Approach and the Advanced Approaches. Advanced Systems Review The Advanced Systems Review is a regulatory mandate that supports the following ongoing requirements: 1. Senior management is responsible for maintaining effectiveness of the bank s Advanced Systems for regulatory capital. 2. The board of directors must review and approve the Advanced Systems annually and offer evidence of how it has assessed their effectiveness. The board s oversight of the Advanced Systems Review should be aligned with and be part of the bank s board-approved strategic plan, a wider internal governance structure, and an enterprise risk management process. The board and its designated committees typically, the risk committee and, in some cases, the audit committee oversee management s monitoring and assessments of the Advanced Systems. Capital requirements can result in overlapping responsibilities between and among committees, requiring close coordination and communication. It is imperative to define board and committee oversight responsibilities, particularly since regulators expect the board to provide effective, ongoing, and credible challenge to the CEO and senior management team. Passivity in this area could well be criticized and penalized by the regulators. As with all areas requiring board oversight, it is the board s responsibility to provide thoughtful and meaningful input ABOUT ADVANCED APPROACHES For directors, the benefits derived from the Advanced Approaches generally include better information and an improved understanding of the bank s risk management practices, better risk assessments, and a clearer perspective on the potential vulnerabilities in calculating capital. Currently 14 banks in the U.S. use the Advanced Approaches, which are mandatory for banks with assets of $250 billion or more. One of the 14 banks chose to opt-in. The scope of coverage is likely to expand. The Advanced Approaches compel a bank to develop and implement systems, processes, and programs in order to comply with extensive and intricate requirements. to management and to exercise skepticism regarding the Advanced Systems Review. The board can do this by challenging the tenets of the systems and critically monitoring compliance. To help the board fulfill its responsibilities, management needs to provide enough information, in the appropriate form and in sufficient time, for directors to ask the proper questions, make the correct assessments, and grant the proper approvals without necessarily having to be subject-matter experts themselves. Composition of the Board To credibly challenge the Advanced Systems, the board must have industryspecific knowledge, an understanding of the business and associated risks, and an informed perspective on the bank s products and services. Some directors and boards may struggle to measure up. December 2014 January 2015 The RMA Journal 73

3 THE BOARD S OVERSIGHT OF THE ADVANCED SYSTEMS REVIEW INVOLVES A MOSAIC OF CHALLENGING TOUCH POINTS REQUIRING A THOUGHTFUL, CAREFUL, AND COMPREHENSIVE APPROACH. IT IS LINKED WITH THE RISK MANAGEMENT PROCESSES. Rodney R. Peck, Partner Pillsbury Winthrop Shaw Pittman LLP A 2013 study by the Financial Stability Board noted that, during the recent financial crisis, many boards of financial institutions were populated with directors who had little financial or industry experience and only a limited understanding of the complexity of the institutions they were leading. Moreover, the study indicated that directors were sometimes unable to dedicate sufficient time to understanding the business model and were too often deferential to management. This deficiency of skills along with willingness to accept management recommendations without sufficient challenge can become particularly critical with regard to board oversight of the Advanced Systems Review. Not only do directors collectively bear this oversight responsibility, but their individual reputations are at risk, as are those of the institutions they oversee. There is an expectation that the board comprises well-diversified and highly experienced directors who together have sufficient knowledge, skills, and abilities to challenge management and to assess and monitor the strategy and the risks. Moreover, it is important that directors have the capacity to dedicate ample time to review information and develop an understanding of the key issues. It is highly recommended that the board conduct periodic self-assessments to determine 1) the extent of directors experience and their knowledge of the bank s businesses and risks, and 2) the capacity of the directors to handle their responsibilities. Pursuant to the OCC s minimum standards, annual self-assessments are an imperative. ICAAP AND CCAR A bank assesses and manages capital requirements and adequacy through its Internal Capital Adequacy Assessment Process (ICAAP). ICAAP is integral to how the Comprehensive Capital Analysis and Review (CCAR) is executed, although the CCAR includes the important additional aspect of including the Federal Reserve s defined stress scenarios. Although not technically an Advanced System but considered part of the broader Advanced Approaches through the supervisory review process, ICAAP has its own set of requirements with significant overlap with CCAR. ICAAP and CCAR ensure that capital planning processes are robust, forward looking, account for unique risks, and confirm that sufficient capital is held to continue operations through periods of economic and financial stress. The qualification requirements of the Advanced Approaches indicate that a bank must have a rigorous process for assessing its overall capital adequacy in relation to its risk profile and a comprehensive strategy for maintaining an appropriate level of capital. Because minimum risk-based capital requirements are based on certain assumptions and address only a subset of risks faced by a bank, each institution should conduct an internal assessment of whether its capital is adequate given its risk profile. A bank must conduct this assessment using the ICAAP process, in addition to its calculation of minimum risk-based capital requirements. Banks implementing Advanced Approaches are required to have an ICAAP that is appropriate for its unique risk characteristics. The ICAAP ensures that internal capital targets and strategies for achieving them are consistent with the bank s business plans, risk profile, operating environment, and regulatory requirements. ICAAP consists of internal procedures, systems, models, and methodologies that ensure that the bank possesses adequate capital resources to cover all of its material risks, again given the bank s business plans, risk profile, operating environment, and regulatory requirements. It includes the identification and measurement of relevant material risks, stress testing and sensitivity analysis, capital budgeting and planning, risk monitoring, capital evaluation, reporting, and data collection activities. CCAR is part of the Fed s program for assessing capital plans. Under CCAR, all U.S.-domiciled, top-tier bank holding companies with total consolidated assets of $50 billion or more are required to develop and maintain a capital plan supported by a robust process for assessing their capital adequacy. Many, but not all, of the 30 CCAR banks use the Advanced Approaches. CCAR evaluates capital planning processes and assesses capital adequacy levels under various scenarios to determine if a bank would have adequate capital to continue operations in times of economic and financial market stress. The Fed s CCAR principles cover many of the ICAAP processes, basically compelling ICAAP-like processes on all CCAR banks. 74 The RMA Journal December 2014 January 2015

4 Moreover, the OCC s minimum standards will require formal ongoing training programs for directors that include sessions on products, services, lines of business, significant risks, and applicable laws, regulations, and regulatory requirements. If the board lacks the qualifications to sufficiently oversee the Advanced Systems Review, consideration should be given to augmenting or changing the board s composition or to enlisting thirdparty support in the more technical or specialty areas. Capital Requirements The board s oversight of capital requirements requires a fundamental understanding of the Advanced Approaches and the Advanced Systems and how they link with risk management. A bank using the Advanced Approaches will design an Internal Capital Adequacy Assessment Process. ICAAP is foundational and a part of a Comprehensive Capital Analysis and Review framework which, under the Federal Reserve s rules, is used to assess overall capital adequacy, based on the bank s risk profile and strategy to maintain an appropriate level of capital. As part of its annual approval of the bank s capital plan and the effectiveness of the Advanced Systems Review, the board must review and challenge the CCAR processes. The results of this review become part of the annual CCAR capital plan submitted to the regulators. Moreover, the board is required to regularly review and annually approve the ICAAP and its components. That review should encompass the ICAAP s effectiveness, the appropriateness of risk tolerance levels and capital planning, and the strength of the ICAAP s control infrastructure. As for CCAR, the board of directors has ultimate oversight responsibility and accountability for its capital planning and needs to be in a position to make informed decisions on capital adequacy and capital actions. At least annually, the board of directors or its designated committee is required to 1) review the robustness of the CONTROL, OVERSIGHT, AND VALIDATION MECHANISMS: BUILDING THE ADVANCED SYSTEMS The processes that are normally followed in building the Advanced Systems are akin to an internal control validation framework tailored for Basel qualification. Basel qualification attempts to establish risk and capital management requirements that are designed to ensure capital adequacy given the bank s risk profile. Banks have flexibility in determining how to achieve integrity in their risk management systems. Nevertheless, they are expected to follow standard control principles such as checks and balances, separation of duties, functional independence, appropriateness of incentives, and assurance of data integrity, including that of information purchased from third parties. Control, oversight, and validation mechanisms for Advanced Systems include the following requirements: 1. Senior management must ensure that all components of the bank s Advanced Systems function effectively and comply with the requirements. 2. The board of directors (or its designated committee) must review and approve at least annually the effectiveness of the Advanced Systems.] 3. The bank must have an effective system of controls and oversight that 1) ensures ongoing compliance with the qualification requirements; 2) maintains the integrity, reliability, and accuracy of the bank s Advanced Systems; and 3) includes adequate governance and project management processes. 4. The bank must validate, on an ongoing basis, its Advanced Systems. The validation process either must be independent of the Advanced Systems development, implementation, and operation, or it must be subjected to an independent review of its adequacy and effectiveness. Validation should include an evaluation of the conceptual soundness of the Advanced Systems, an ongoing monitoring process that includes verification of processes and benchmarking, and an outcomes analysis process that includes back-testing. 5. The bank must have an internal audit function independent of business-line management that assesses at least annually the effectiveness of the controls supporting the Advanced Systems and reports its findings to the board (or a committee thereof). 6. The bank must periodically stress test its Advanced Systems. The stress testing must include a consideration of how economic cycles, especially downturns, affect risk-based capital requirements. December 2014 January 2015 The RMA Journal 75

5 THE ADVANCED SYSTEMS REVIEW PROVIDES A CRITICAL AND INDEPENDENT VERIFICATION MECHANISM, SEPARATE FROM OTHER EXISTING FUNCTIONS SUCH AS INTERNAL AUDIT, TO ASSURE THAT THE BANK S ADVANCED SYSTEMS AND PROCESSES ARE WORKING AS EXPECTED. Jennifer O Reilly, Senior VP, Risk Reporting and Analysis MUFG Union Bank process for assessing capital adequacy, 2) ensure that deficiencies in the processes for assessing capital adequacy are remedied, and 3) approve the capital plan. The board s review of capital adequacy should determine that, consistent with safety and soundness, the bank s capital plan takes into account all material risks and is appropriate for its risk profile. Regulators expect the board will receive sufficient information to understand the bank s material risks and exposures and to inform and support its decisions on capital adequacy and planning. Best practices suggest that involvement by directors in the CCAR process should ensure their ability to do the following: Understand the bank s risk exposures, activities, and vulnerabilities. Identify the major drivers of revenue and loss changes under various scenarios. Harness board expertise to evaluate the information provided by senior management. View the results as estimates that represent a range of possibilities. Assess the impact of weaknesses. Calibrate the range of potential stress events and conditions. The objective of oversight is to ensure that the various systems used in determining risk-based capital requirements are operating as intended. The oversight process should draw conclusions about the soundness of the components of the risk management system, identify errors and flaws, and recommend corrective action as appropriate. Moreover, the oversight process should be sufficiently independent of the Advanced Systems development, implementation, and operation to ensure the integrity of the component systems. The regulators guidance suggests that an independent verification process that effectively challenges the rigor and accuracy of the bank s approach is helpful in ensuring initial and ongoing compliance. Although management is responsible for evaluating and ensuring that the Advanced Systems function effectively and comply with the qualification requirements, the rules make it clear that the board is ultimately responsible for the effectiveness of the Advanced Systems. Advanced Systems Review Program The Advanced Systems Review program provides the board with an independent verification mechanism for gaining comfort that the systems and processes fortifying the Advanced Approaches are operating effectively. The Advanced Systems Review will center, as a primary focus, on attestations of effectiveness by those who own the systems and processes and separate challenges from other independent existing functions. The system or framework is intended to ensure regular assessments and reporting on the Advanced Approaches. All of these components should be executed with the goal of supporting the board s annual review and approval. The Advanced Systems Review process can be structured in a variety of ways but should address the required capabilities, including exposure classification and risk identification, risk measurement and assessment, models and methodologies, data management, risk-weighted asset calculations and capital reporting, validation and verification mechanisms, and governance and reporting. The process areas, which often go beyond the formerly defined Advanced Systems, may include wholesale credit risk, retail credit risk, counterparty credit risk, securitizations, equities, non-material portfolio and other assets, operational risk, market risk, and ICAAP. The Advanced Systems Review often journeys through multiple levels of scrutiny. Assessments at the most granular level are performed by individuals who are close to the process and who have relevant subject-matter expertise. These self-assessments are, in turn, reviewed and incorporated into higher-level assessments. Although many approaches are employed, some banks establish, though not specifically require, an independent challenge team or a similar group to provide an independent view and credible challenge to management s self-assessment results. The independent challenge team reviews the results of management s self-assessments, questions and challenges the rationale supporting the prechallenge assessments, and signs off on the final results. If established, the independent challenge team comprises individuals who understand the bank s products and services, possess requisite subject-matter knowledge, and hold sufficient stature within the bank to conduct an independent challenge. Upon completion, the self-assessment reports and the findings of the independent challenge team, if one is established, are presented to the board or its designated committee. Key conclusions, highlights of the assessments, and commentary on common themes emerging from the assessments are reviewed. Summaries 76 The RMA Journal December 2014 January 2015

6 indicating the effectiveness of important capabilities and associated process areas are examined, and assessment outcomes and summaries are challenged with the results approved by the board. The bank must document all material aspects of its Advanced Systems, including the nature and extent of board oversight. Best practices suggest that board materials and board minutes should describe the information provided to the board, the extent of the board s review and challenge, and details on how results or conclusions were reached. Expectations of the Regulators The regulators minimum standards describe the board s basic duties of oversight. It suggests, among other matters, that the board must actively oversee the bank s risk-taking activities, acquire a thorough understanding of the bank s risk profile, and hold management accountable for adhering to the framework, including questioning, challenging, and opposing decisions that could cause the risk profile to exceed the bank s risk appetite or that could jeopardize bank safety and soundness. The minimum standards may require more revolution than evolution for some boards. A director s understanding of the regulators expectations in regard to the Advanced Systems review is essential. It is not the board s responsibility to become engaged in the day-to-day management of the Advanced Systems, but the regulators do expect the directors to understand them and be actively engaged. The board s oversight of the Advanced Systems Review is intended to be a dynamic and evolving process supporting management s proposition that capital is adequate given the bank s risk profile. In practical terms, the regulators expect the Advanced Systems to include all components of the bank s Advanced Approaches program, including policies, processes, procedures, controls, tools, models, data, and systems. The regulators generally anticipate that a designated group within the bank would be primarily responsible for providing data for the board s review and approval. This group would be tasked with collating relevant information and coordinating activities. Evidence of how the board ensures that the Advanced Systems are effective is an imperative. The evidence should also demonstrate attestations of not only the work-stream owners but also, in some cases, an independent challenge team apart from internal audit. The regulators guidance suggests that internal audit should have a comprehensive understanding of the control environment supporting the Advanced Approaches framework, including associated policies and procedures that document how the bank achieves initial and ongoing compliance. The regulators expect internal audit to regularly share its views with the board and to give annual opinions on the systems. Because the Basel rules and the regulators have a high governance requirement for the independent validation of the Advanced Systems quantitative elements, these high governance thresholds are most likely required also for the qualitative aspects. FAILURE TO COMPLY If the regulators determine that a bank using Advanced Systems to calculate its risk-based capital requirements has fallen out of compliance with one or more of the qualification requirements, the regulators will notify the bank of its failure to comply, potentially impacting the non-objection to the bank s capital plan. After receiving such a notice, a bank must develop and submit a satisfactory remediation plan for returning to compliance. If the regulator determines that the Advanced Systems are not commensurate with the bank s credit, market, operational, or other risks, the regulator may require the bank to calculate its total risk-weighted assets under the Advanced Approaches and then make any required modifications. Additionally, the regulators may require public disclosure if noncompliance is significant, which undoubtedly would invite reputational risk. In March, the Federal Reserve objected to the capital plans of five firms while approving the plans of 25 others. The Fed said it objected to four of the plans because of qualitative concerns and that one had failed to meet a minimum, post-stress capital requirement. December 2014 January 2015 The RMA Journal 77

7 QUESTIONS DIRECTORS SHOULD ASK ABOUT THE CAPITAL PLANNING PROCESS AND ADVANCED SYSTEMS REVIEW 1. Is the capital plan aligned with the bank s strategic plan that the Directors reviewed and approved? 2. Capital Planning Process and Assumptions a. Has the population of risks and impacts been appropriately captured in the capital planning process? b. What are the other assumptions of management s capital planning process? c. How has management validated its assumptions, data, scenarios, models and tools? d. Has an independent challenge team or similar group been established? If so, what is the nature and extent of the reviews and challenges? Are the appropriate cross-functional skills, knowledge and stature present in the challenge team? 3. Capital Planning Process Results a. How has management documented the capital process results and related validation of the Advanced Systems? b. What are management s key concerns with its Advanced Systems? c. What is the assessment of the capital planning process, assumptions, results and management s remediation plan from internal audit? i. Quantitative Requirements and Peer Analysis ii. Qualitative Requirements and Peer Analysis d. What findings of the Advanced Systems Review could jeopardize the bank s capital plan, capital adequacy, capital actions or standing with the regulators? e. Has the bank s Advanced Systems Review program been reviewed by the regulators? What were the key findings or recommendations and have these been incorporated in the current capital plan and process? f. What are the findings of internal audit s annual assessment of the effectiveness of controls supporting the Advanced Systems? What was the scope of the review by internal audit and what was the nature of testing for compliance with the qualification requirements? g. For identified areas of gaps or weakness (identified either by management, through validation processes or internal audit), what are the processes and timeframes for remediation? 4. Directors credible challenge a. What points have the Directors raised regarding the capital planning process and its assumptions. b. What points have the Directors raised regarding the quantitative and qualitative results of the capital plan? c. How will these matters be evidenced and documented and what follow up will management provide to the Directors? d. How will the Directors be informed of progress?????? 78 The RMA Journal December 2014 January 2015

8 A BANK USING THE ADVANCED APPROACHES MUST MEET THE QUALIFICATION REQUIREMENTS ON AN ONGOING BASIS. BANKS ARE EXPECTED TO IMPROVE THEIR ADVANCED SYSTEMS AS THEIR BUSINESS-DATA -GATHERING CAPABILITIES IMPROVE AND AS INDUSTRY PRACTICE EVOLVES. Preston Thompson, Executive Director Ernst & Young LLP Dean A. Yoost is a member of the board of directors of MUFG Union Bank and Pacific Life Insurance Company, as well as an advisory board member of American Honda Finance Corporation. He spent 33 years with PricewaterhouseCoopers and served as a member of PwC s Global Oversight Board. He can be reached at deanyoost@cox.net. Notes 1. The term bank includes banks, savings associations, and bank holding companies. Bank holding company refers only to bank holding companies regulated by the Federal Reserve and does not include savings-and-loan holding companies. 2. Advanced systems include the bank s advanced internal ratings-based systems, operational risk management processes, operational risk data and assessment systems, operational risk quantification systems, and, to the extent used, internal models methodology, advanced credit valuation adjustment approaches, double default excessive correlation detection processes, and the internal models approach for equity exposures and market risk. 3. There are three pillars of the Advanced Approaches: Pillar 1 (covering minimum capital requirements), Pillar 2 (covering the supervisory review process), and Pillar 3 (covering market discipline). LISTING OF REGULATORY GUIDANCE The reader may wish to refer to the following releases from the federal regulators: U.S. Implementation of Basel Accords (Source: Federal Reserve Website) December 6, 2013: Federal Reserve Board issues final rule aligning market risk capital rule with Basel III October 24, 2013: Federal Reserve Board issues proposed rules to strengthen the liquidity positions of large financial institutions September 24, 2013: Federal Reserve Board issues interim final rules clarifying how companies should incorporate Basel III reforms into capital and business projections July 9, 2013: Federal Reserve Board releases interagency New Capital Rule: Community Bank Guide New Capital Rule: Community Bank Guide July 2, 2013: Federal Reserve Board approves final rule to help ensure banks maintain strong capital positions Federal Register notice: PDF Community Bank Guide (PDF) July 2, 2013: Federal Reserve proposes to revise its market risk capital rule 2014 RELEASES FROM THE OFFICE OF THE COMPTROLLER OF THE CURRENCY (SOURCE: OCC WEBSITE) OCC : Regulatory Capital Revisions to the Risk-Based Capital Definition of Eligible Guarantee for Advanced Approaches Banks: Final Rule NR : Agencies Finalize Technical Correction of Risk-Based Capital Rules OCC : Regulatory Capital Proposed Revisions to the Supplementary Leverage Ratio: Notice of Proposed Rulemaking BASEL COORDINATION COMMITTEE BULLETINS (SOURCE: FEDERAL RESERVE WEBSITE) BCC 14-1: Supervisory Guidance for Data, Modeling, and Model Risk Management Under the Operational Risk Advanced Measurement Approaches BCC 13-7: Implementing the Supervisory Formula Approach for Securitization Exposures BCC 13-6: Guidance for Internal Audit under the Advanced Approaches Rule BCC 13-5: Applying the Requirement for Conservatism to the Parameters in the Advanced Approaches BCC 13-4: Guidance Statement on Implied Support BCC 13-3: Guidance for Independent Verification of a Banking Organization s Advanced Approaches Systems BCC 13-2: Excluding Exposures to Investment Firms from the Definition of Traditional Securitization BCC 13-1: Excluding Non-material Portfolios of Exposures from the Advanced Approaches ( Exclusion Treatment ) See also Stress Testing and Capital Planning Links on the Federal Reserve Website August 2013: Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice December 2014 January 2015 The RMA Journal 79