The Basel II Accord is ushering in a new and complex environment for calculating capital. Dr Pat McConnell ponders whether the new rules will encourage banks to game the system

Major banks around the world are required under the new Basel II rules to use the so-called Advanced Measurement Approach (AMA) when calculating Operational Risk Capital (ORC). The rules for calculating capital under an AMA are complex and demanding, requiring firms to meet stringent quantitative and qualitative criteria before their model is approved by their local regulator. This paper looks at just one of these mandatory criteria – that a bank must be able to allocate “economic capital for operational risk across business lines in a manner that creates incentives to improve business line operational risk management” [Basel II Clause 665].

This is a worthy goal designed to encourage business managers to participate actively in improving the processes of operational risk management in their business lines. But is this commendable requirement realistic, useful and more importantly achievable in practice? This article argues that, given the rules laid out in Basel II, it will be extremely difficult for operational risk managers to make convincing cases for rational investments by business to reduce ORC. Furthermore, rather than being an incentive to improve operational risk management throughout the industry, operational risk capital could be little more than a regulatory tax on business that will eventually become absorbed into ‘business as usual.’

Selected data from the 2005 annual reports of the five major banks in Australia, all of which are applying for AMA approval from the local banking regulator, APRA (Australian Prudential Regulation Authority) shows all banks are holding capital well in excess of the Minimum Regulatory Capital (MRC) required by Basel II, i.e. 8 per cent of Risk Weighted Assets (RWA). For 2005, operational risk capital did not have to be broken out explicitly from the regulatory capital numbers reported by each bank.

However, as part of the prolonged discussions leading up to Basel II, the ratio of ORC to total regulatory capital was a hot topic, being reduced by the Basel committee from an initial 20 per cent to a ‘suggested’ 12 per cent. Even at this reduced level operational risk capital charges are not insubstantial, ranging, in these cases, from .46 to 2.7 billion dollars, certainly large enough to prompt executives to consider how these numbers could be reduced. Before considering how these large values can be reduced, the ratio of ‘economic’ ORC to MRC must be considered. In a study of ORC held by large US banks, researchers from the Federal Reserve Bank of Boston found that, based on the banks’ own internal loss data and the 99.9 per cent confidence interval required under Basel II, operational risk capital should range from 5 per cent to 9 per cent of MRC – a considerable reduction on the 12 per cent suggested ratio and a strong argument for applying for an AMA approach under Basel II. However, the researchers observed that the banks concerned were actually holding economic capital for operational risk between 12 per cent and 15 per cent of MRC.

Why are banks holding much more capital than would be required if only historical losses were considered. In short, up to half of the operational risk capital held by banks may result from subjective assessment of the impact of factors that are not directly observable. In this context, the question must be asked – if the major factors cannot be objectively quantified, can they reasonably be managed downwards? For the purposes of this analysis the high-end ratio of 15 per cent is used to illustrate the difficulties of actu

ally managing down economic capital numbers. It should be noted that if a lower ratio were assumed, the

problem would be even more difficult because there is less room to reduce capital and hence capital costs.

Table 2 (opposite) shows the costs to business lines of holding ORC (at the high-end observed level). Using

the actual cost of capital used by each bank in their annual report, the Cost of Operational Capital (CORC)

is calculated, e.g. for NAB there is an overhead of $396 million that must be earned before profit just to cover operational risk capital charges.

Using reported Total Operating Expense figures, the ratio of the Cost of ORC to operating expense is

calculated, yielding a ratio of between 4.6 per cent and 7 per cent across the banks. These are not insignif

icant numbers and any manager worth his/her salt should be encouraged by the prospect of eliminating

around 5 per cent of their manageable expenses. But are potential savings achievable or are they illusory

like the emperor’s new clothes?

To illustrate the problem in reducing the economic cost of operational capital, the table shows the latest

year on year variation in operating expense for each bank – some expenses are up, some down – but the

annual variation averages around 9.4 per cent of total expenses (as against an average CORC of 5.5 per cent). This means that the Cost of ORC is comparable with, and sometimes swamped by, normal year-on-year variations in total operating expense, i.e. this number may be may be lost in market ‘noise.’

As it is impossible to eliminate operational risk altogether, practical savings in CORC may be small

in comparison with normal expense variations, such as annual staff pay increases, or major infrastruc

ture upgrades. Aside from initiatives to harvest ‘low hanging fruit,’ investments designed to reduce oper

ational risk are likely to be considerable, since meaningful reductions would invariably require sig

nificant changes to a firm’s ‘core’ business processes and technology. It should also be noted that

the figures in Table 2 reflect bank-wide rather than business-line level costs. Given that Basel II has

identified eight distinct business lines, the room for significant dollar savings by individual business-

line managers is greatly reduced.

In order to make worthwhile savings in the cost of operational risk capital, managers must be able

to make a rational comparison of investment opportunities and select the mix that will give optimal,

predictable and consistent returns. Unfortunately, Basel II rules make comparison of returns on such

investments extremely problematic. To qualify for AMA approval, a bank is required to estimate Operational Risk Capital according to stringent ‘quantitative criteria’, which include, as stated in Basel II: a bank must be able to demonstrate that its approach captures potentially severe ‘tail’ loss

events with ... a 99.9th percentile confidence interval (Basel II clause 667); banks must track internal

loss data ... based on a minimum five-year observation period (clause 670); and a bank’s operational

risk measurement system must use relevant external data (either public data and/or pooled industry

data), especially when there is reason to believe that the bank is exposed to infrequent, yet potentially

severe, losses (clause 674).

Because undue emphasis is placed in Basel II on ‘tail events’ (99.9 per cent confidence level), busi

ness-line managers will find it difficult to make rational investment decisions to mitigate such extreme

events. By their very nature, extreme loss events are difficult to predict – in both their timing and their

financial impact – so that the return on an investment to eliminate/mitigate such events cannot be evaluated

accurately, predictably nor consistently. Firstly, a severe event may not occur within the investment period, making the investment pretty much worthless, unless it can be demonstrated after the fact that the investment did, in fact, prevent one or more events that would have produced a 99.9 percentile loss. Likewise, since a rare event will have unpredictable financial consequences, calculating

the return on an investment is little more than a guess, albeit backed up with some statistical sci

ence. Investment funding is not unlimited and faced with a choice between a sure investment, such as

staff reductions (which may in fact increase operational risks) and an uncertain investment, such as

reducing the capital cost of losses due to avian flu, managers will invariably and rationally choose the

more certain investment. Note this does not mean that managers should not address the very real poten

tial impact of an avian flu pandemic, merely that they should ignore the conceit of attempting to cal

culate the capital savings of making the investments necessary to reduce its impact.

Secondly, charges for operational risk capital under Basel II are dependent on a five-year history of inter

nal losses and as a result it may take several years for the impact of a single extreme event to work its way out of the system. This means that money invested today may not be recognised as producing significant capital savings for a number of years. Faced with such a situation it would be perfectly rational for a manager to delay any such investment, probably indefinitely.

Finally, even though prudent managers may wish to make the investments necessary to reduce their operational risk capital charge, they are subject to events beyond their control, since they are forced to consider ‘relevant external data.’ This means that if another bank were to incur a severe loss in a relevant business line, the impact of that loss must be factored into the bank’s own capital calculation. This implies that, despite investing in risk management as required by Basel II, a bank may still not achieve predicable returns on its investments because of losses in less well-managed firms – hardly a level playing field.

Taken together, the quantitative criteria in Basel II make calculating the returns on investments to reduce

operational capital charges exercises in fantasy, producing results that would not stand up to rigorous investment analysis. Faced with such uncertainty, business line managers will undoubtedly choose to spend their scarce resources on investments that they understand, that they can control and which will give an assured return.

If so, the costs of ORC, plus, it must be noted, the costs of the Operational Risk Management infrastructure demanded by Basel II, will become just another fixed overhead or tax on doing business. So if individual business lines cannot make rational investments to reduce the Cost of ORC, what will be the business impact of ORC charges? After ‘low hanging fruit’ have been harvested and investments have been

made to tackle the ‘biggest ticket’ risks, especially those highlighted by regulators, the costs of any remaining ORC will, after a few years, become too difficult to manage down. In such situations, unfortunately, unscrupulous managers will manage these costs by other means. For example operational risk capital can be managed downwards by simply not reporting losses, or characterising them under some other expense categories. Where subjective judgement is involved, such as with scenario analysis or ‘risk self-assessment,’ it is even easier to ‘game the system’ by under-estimating or even deliberately ignoring low-frequency risks. A recent research paper identifies several other ‘unintended consequences’ of Basel II operational risk requirements, including: false reliance, misplaced faith on incomplete, unverifiable models; management of the model rather than reality; misdirected focus, concentrating on historical rather than future potential losses; misdirected resources, focusing on regulatory compliance rather than business imperatives; discouragement of whistleblowers, bad news is not welcome as it increases costs; and ‘blissful ignorance,’ a tendency to reward those who do not recognise problems. Unfortunately, it is only as the Basel II rules are applied in practice in years to come will the true impact become apparent – if the requirements prove impractical a valuable opportunity to improve risk management for the benefit of shareholders will have been lost.

The Basel II rules for calculating Operational Risk Capital for major banks are skewed in such a way that

it is extremely difficult to create incentives for business lines to achieve significant savings in capital

charges using conventional investment analysis. In such a situation, it is easier for business lines to accept

capital charges as a tax or a cost of doing business and to target their investments elsewhere, where returns

are predictable and consistent. In the worst case, the Basel II rules may encourage firms to ‘game the sys

tem’, deliberately underestimating risks and dressing minor investments up as major risk management ini

tiatives. The goal of improving operational risk management is worthy; it is the mechanism of operational

risk capital as a stick that is flawed. Regulators should reconsider the undue emphasis on ‘extreme events’ in Basel II and search for simpler mechanisms which reward banks that demonstrate consistent, continuous,

albeit un-spectacular, improvements in their operations and operational risk management capabilities.

Dr Patrick McConnell is a partner with Risk Trading Technology and an adjunct

at the Macquarie University Applied Finance Centre