Mitigating Operational Risk Exposure: Risk Transfer Solutions

ABA OPERATIONAL RISK MANAGEMENT FORUMApril 17th 2008

Michel Rochette, MBA, FSA

ENTERPRISE RISK ADVISORY, LLC

Topics

• Context and recent developments

• Opportunities to go beyond Basel II compliance

• Op risk mitigation environment:– Self mitigation– Self insurance– Risk transfer:

• Insurance mitigation• Alternative risk transfer: Captives• Capital markets solutions

• Case: Insurance mitigation optimization

Context:

“Regulators are becoming concerned that banks may seek to manage the [Operational Risk Capital] charge rather than to manage the risk itself”

Susan Schmidt Bies, Federal Reserve Board Governor

New York, March 29, 2006

Reminder: Sound Practices Paper-BIS 2003

• Development of an appropriate op risk mgt environment:– Board level & management with clearly defined roles.

• Risk Management: – Identification– Assessment– Mitigation & monitoring– All material activities, products, processes and systems

covered– Monitor operational risk profile – Policies/processes/procedures to manage the risk– Must chose appropriate risk mitigation strategies in light

of their risk appetite.

StrategicBasel IIOperational Risks

Financial Business

Attracting & retaining talentCompetition

Managing organizational changeM&A/business diversification

New product strategyNew market strategy

Outsourcing and supplier chainGovernance of risk

Interest ratesCredit environment

LiquidityFX environment

Equity environmentFinancial liabilities

Internal processesSystem failureInternal/External FraudEmployment practices: Health & Safety / Loss of Key PeopleClients/products/Business practicesExternal incidentLegal impact includedInsurance allowed as mitigant

Brand/ReputationCorporate social responsibilityProduction volumes/pricing impactLoss of Intellectual propertyOther risk mitigation integrated

Operational Risk: ERM View

US Regulators’ Expectations: AMA

• Risk-Based Capital Standards. – Applies to IRB and AMA only at this time. – Banks with $250 billion US+ in consolidated assets. –Core –– Other banks may adopt this new framework: - Opt–in -– Standardized approach for general banks will be finalized in Q1-

2008 with qualifying criteria.

• Compliance and op risk must be analyzed together: – Definition of loss is consistent with Basel II including legal losses.– Legal loss: litigation, settlements, fines resulting from failure to

comply with laws, regulations, prudent ethical standards, contractual obligations in any aspect of the bank’s business.

– May also explain industry interest to implement GRC/ERM.

US Regulatory Criteria for Other Mitigant

• Regulators are open to other risk mitigant approaches if:

– FI must calculate its operational risk exposure.– Mitigant must be able to absorb losses with sufficient certainty.– Must receive prior written approval.

• Mitigant must cover potential operational losses in a manner consistent with holding regulatory capital.

• Regulators will consider other risk mitigant in due course on “ the basis of growing experience”. – Insurance industry has that experience. – Not necessary to reinvent the wheel.– European regulators are taking a fresh analysis of op risk mitigant.

Operational Risk Mitigant Environment

Expected Unexpected Catastrophic

Yearly Profit/Internal

Controls

Purely Self Insurance/

Insurance/ART

Insurance/

Capital Mkts

Benefits of Integrating Operational Risk Mitigant

• Business perspective:

– Your institution is NOT in the business of managing op risk. → Low TOLERANCE for this risk.

– Insurance is in the business of managing op risk. → APPETITE for op risk.

– These businesses are complementary, should work together and be more integrated internally.

– This trend is observed more and more.

• Regulatory perspective:

– “Agencies will take into account whether a particular operational risk mitigant covers potential operational losses in a manner equivalent to regulatory capital”.

– Mitigant would cover insurance and other approaches subject to certain minimum qualifying criteria.

Universe of Op. Risk Mitigation: Characteristics

• Internal management: controls– Implemented without much consideration of the costs involved. – Embedded in the AMA calculations through control effectiveness

scores.• Self insurance:

– Calculating and allocating regulatory capital for op risk is a form of self insurance by banks.

– “Insurance” is direct if calculated by AMA.– “Insurance” is indirect if embedded in the regulatory credit capital

as traditionally done by banks in the general regulatory rules. • Insurance:

– Always existed.– Private and public solutions. – Not integrated very often with operational risk groups.– Standard policies don’t always match. – Optimization of the insurance buying decision in relation to the

operational risk exposure is not usually done.

Universe of Op. Risk Mitigation: Characteristics

• Alternative Risk Transfers (ART):– Used by companies to mitigate risks that the traditional

insurance markets cannot cover.– Probably already used by some of your institutions without

your knowledge!– Covers services like Captives for op risks like workers comp

and external events.• Capital markets solution:

– In existence for some op risks, mostly external events.– Some op risks are securitized like CAT Bonds.– Cover both risk transfer and risk finance solutions. – More talk in the industry about op risk derivatives.

Operational Risk Mitigant Environment

Expected Unexpected Catastrophic

Insurance

US Op Risk Requirements vs. Insurance

• Definition of op risk loss:– All expenses associated with

a loss event except:• Opportunity loss• Foregone revenues• Costs to

enhance/correct/prevent future op. risk events.

• No prescribed methodology:– Most banks use LDA.

• Op. Risk Capital is like self-insuring the risk.

• Insurance is to indemnify: – Regulatory definition of loss

is similar to insurance definition of loss.

• Insurers pricing methods:– ALL use LDA– EOL = Deductible – UOL = What insurers usually

pay.

• Insurance is contingent capital to your bank.

US Regulatory Limitations of Insurance

• Risk Based Capital Relief of insuring some op risk exposure, MAXIMUM of:– Op. Risk Exposure adjusted for qualifying op risk mitigant

minus offsets (if, any)– 80% * (op risk exposure – offset ).

• Implications:– If your institution is an AMA, regulatory relief of integrating

mitigant is limited but not the business benefit.– If your institution is not AMA, better managing op risk will

reduce your “indirect” op risk capital that is embedded in the credit capital through a better management of the premiums/costs of your traditional insurance overages.

Operational Risk Mitigant Environment

Expected Unexpected Catastrophic

Insurance/

Capital Mkts

Capital Markets Solutions- Overview

Type Insurance Risk transfer: Securitization/ILS/Exotic Ins Structures/Op Risk Derivative

Contingent Capital (CAT Bond for liquidity)

Credit Quality Varies by counterparty

Collaterisation Varies by counterparty

Term One-year Single/multi yr. Single/multi yr.

Payment Trigger

Indemnity Index based Pre defined, timely issuance of securities

Covered Perils Virtually any op risk

Natural/man-made risks

Natural/man made risks.

Summary of Risk Transfer Solutions

Level of Exposure Risk Solution AdvantagesType of Exposure

Expected

Unexpected

Low

Medium

High

Catastrophic

Yearly Profits/Internal

controls

Operating Group focus Efficient

Yearly profits/controls/Art

Art, Self Insure, Insurance

Capital markets, government, insurance &

capital market hybrid

Cash flow

Diversification Pooling Established Mechanism Long-term Access to very large

pool of capital

Questions

Michel Rochette, MBAENTERPRISE RISK ADVISORY, LLC954-607-6969michel.rochette@enterprise-risk-advisory.com