AMA at the EIB

March 2009

Agenda
Operational risk framework Basel II and the advanced measurement approach (AMA) Adjusted risk capital (ARC) Worked example

Operational risk framework

Operational risk policy
Operational risk methodology Historical data KRIs Information on internal controls Scenario analysis Operational risk system: SAS

Basel II and the advanced measurement approach (AMA)

Basel II / AMA Approaches

Basic 15% of Gross Income

Standardized 15% of Gross Income

Alternative Standardized 15% x 3.5% of Assets

Only capital calculation, no risk measurement

Advanced Measurement Approach Risk Measurement, Loss Data Base, Risk Exposure Report, Capital Calculation Engine

EIB and Basel II Qualifying Criteria

Under Basel II / CAD Existing Situation Objective

Basic

Stand.

Altern. Stand.

AMA

Operational Risk Policy

Yes

No

Yes

Yes

Yes

Keep Existing Operational Risk Policy

Operational Risk Exposures Report

Yes

No

Yes

Yes

Yes

Keep Existing Operational Risk Report

Loss Data Base

Yes

No

Yes

Yes

Yes

Keep Existing Loss Data Base

Capital Calculation Engine

No

No

No

No

Yes

Implement Capital Calculation Engine

Basel II Capital Requirement

N/A

265M

265M

1,300M

Approx. 100 M 150 M

Motivations for AMA

Basel II / CAD Large international bank Triple A rating Non profit Key objective is best practice not capital

AMA Key Elements

Scenario Analysis

Preliminary analysis

Scenario Analysis

Services validation
Scorecard / KRIs

Business Environment & Internal Control Factors

Key Risk Indicators since 2001

Operational Events and Losses

120% 100% 120% 100% 80% 60% 40% 20% 0% 2002 2003 2004 Years 2005 2006 Operational Events Operational Losses

Internal Data

Events

80% 60% 40% 20% 0%

Database of events and losses since 2002

External Data

SAS Global Data

Losses (EUR)

Adjusted risk capital (ARC)

Adjusted Risk Capital (A.R.C.)

Operational Risk Management Model Key Principles ARC Capital adjustment Reporting

Operational Risk Management Model

OR Governance OR Measurement

Strategy and Policy ORM

Organizational Structure

Internal Data

External Data

OR Framework & Processes

Scenario Analysis

Business Environment

Qualitative Requirements

Quantitative Requirements

Key Principles

Management comes before measurement No appetite for Operational Risk You can do everything, but you cannot do it alone

Annual risk assessment process

Historical Data Internal/External

Frequency of events
0 1 2 3 4

Preliminary analysis

Severity of loss
0-10 1020 2030 3040 4050

Mean 99.9th Percentile Annual Aggregate Loss ($)

Prior VAR

Scenario Analysis
Adjusted parameters and distributions

LDA model New Loss Data

Business and internal control environment Key Risk Indicators

New KRIs

Adjusted VAR

Preliminary analysis

Historical data on frequency and impact

Distribution of losses based on historical data

Stress testing based on scenario analysis

Historical data on frequency only

Distribution of losses based on scenario analysis. Scenario frequency based on historical data Scenario impact to include extreme (stress) losses Distribution of losses based on scenario analysis. Scenario impact to include extreme (stress) losses

No historical data available

Scenario identification
Events with losses already happened Near misses ICF Audit points with AAPs Events identified by management Events identified through external info

Scenario assessment

Frequency of occurrence Severity of impact Worst case (substantial deviation from business as usual)

Services assessment
Is each scenario credible? Need to modify/discard? Are estimates (probability, impact, worst case) reasonable? Are there other scenarios to consider? In this case what are probability, impact and worst case?

Business and Control Environment

Treasury Process Scorecard 2006 Q1
Indicators Units Value Evolution1 Threshold %
2

Limit3

Front office trade capture Number of treasury portfolio deals Percentage of new transactions Number of cancellations and rejections in FK Back office transaction processing and accounting Number of payments and transfers Number of cancellations and rejections in payments and transfers Average number of outstanding items older than 7 days at month end in the nostro accounts reconciliation. Number of cancellations and amendments in Swift Alliance Number of manual interventions in accounting Risk and control environment Total Operational Losses Risk Assessment score from ICF System server downtime during working hours EUR Score hrs 7,500 1 0 0% -95% 1,000 1 0 150,000 2 2 # # working days # # 6,586 178 27 141 63 -13% -1% -15% 14% 9,000 90 25 100 25 15,000 180 40 250 40 # % # 2,819 0 60 -50% 10% 3,000 0 40 4,000 10 100

Business and Control Environment

Indicators Scores 4 Weight 5 Activity 6 Process 7
1.7 Front office trade capture Number of treasury portfolio deals Percentage of new transactions Number of cancellations and rejections in FK Back office transaction processing and accounting Number of payments and transfers Number of cancellations and rejections in payments and transfers Average number of outstanding items older than 7 days at month end in the nostro accounts reconciliation. Number of cancellations and amendments in Swift Alliance Number of manual interventions in accounting 8 Risk and control environment Total Operational Losses Risk Assessment from ICF System server downtime during working hours 2.0 1.0 2.0 1.0 2.0 2.0 2.0 3.0 1.0 1.0 2.0 1 1 2 2 1 1 2 2 2 2 1 3 2 2 1.7 2.1 1.4

Capital Adjustment

A.R.C. Reporting

Presiden t

Monthly Report Quarterly Report Ad-hoc Report

Board of Directors

Management Committee

Directors general, Internal Audit, External Audit, Audit Committee

Worked Example

Preliminary analysis with historical data

Level 3 Business Level Average Average Freq. impact Worst Case
1.1.1 Internal fraud Unauthorized transaction not reported 6.1.1 Losses arising from system failures Hardware 7.1.1 Transaction capture, execution and maintenance Data entry, maintenance or loading error A trader deals in unauthorized derivatives and hides losses in a dummy account. N. A. N. A. N. A.

A system failure on a major payment date leads to inability to settle a portion of that days transactions. BODY OF DISTRIBUTION (based on historical losses) A mis-specified SWIFT code leads to an incorrect payment. STRESS SCENARIO FOR TAIL OF DISTRIBUTION A payment is sent out just before a counterparty defaults.

Once a year

N. A.

N. A.

Four times a year Once in 50 years

15,000

450,000

70M

126M

Preliminary analysis including scenarios

Level 3 Business Level Average Average Freq. impact Worst Case
1.1.1 Internal fraud Unauthorized transaction not reported 6.1.1 Losses arising from system failures Hardware 7.1.1 Transaction capture, execution and maintenance Data entry, maintenance or loading error

A trader deals in unauthorized derivatives and hides losses in a dummy account.

Once in 10 years

1M

50M

A system failure on a major payment date leads to inability to settle a portion of that days transactions. BODY OF DISTRIBUTION (based on historical losses) A mis-specified SWIFT code leads to an incorrect payment. STRESS SCENARIO FOR TAIL OF DISTRIBUTION A payment is sent out just before a counterparty defaults.

Once a year

10,000

150,000

Four times a year Once in 50 years

15,000

450,000

70M

126M

Results of review with the services

Questions What is your risk of incurring losses related to 1. Internal Fraud Unauthorized Activity 6. Business disruption and system failures 7. Execution, Delivery & Process Management Answers (self-assessment) Mean frequency Once in ten years Mean severity (EUR per event) Between 1M and 5M Between 10,000 and 50,000 Less than 10,000 Worst case (EUR per event) Between 50M and 150M Between 50,000 and 150,000 Between 150,000 and 500,000 Between 50M and 150M

Results
VAR (EUR)

32,300,000

Once a year

471,823

Quarterly

1,061,082

Once in 50 years Total VAR Total Operational Risk Capital (EUR)

Between 50M and 150M

20,000,000

53,832,905 53,832,905

Integration with new loss data

During the first three months of the year, two events in Risk Category 6., with losses of 40,000 and 60,000, respectively. Risk assessment is updated accordingly.
Lognorm(30000; 42500) Trunc(0;+inf)
4.0 2.5

Lognorm(400000; 280000) Trunc(0;+inf)

3.5 2.0 3.0

Values x 10^-5 Probability

Values x 10^-6 Probability

2.5

1.5

2.0

1.0 1.5

1.0 0.5 0.5

1200

1800

2400

600

350

400

450

500

100

150

200

250

300

50

0.0

0.0

Losses Values in Thousands 99.9% 0.0 0.1% > 440.0 0

Losses Values in Thousands 99.9% > 2350

Results with New internal loss data

Questions What is your risk of incurring losses related to Mean frequency Answers (self-assessment) Mean severity (EUR per event) Between 1M and 5M Worst case (EUR per event) Between 50M and 150M Between 150,000 and 500,000 Between 150,000 and 500,000 Between 50M and 150M

Results
VAR(EUR)

1.Internal Fraud Unauthorized Activity

Once in ten years

32,300,000

6. Business disruption and system failures 7. Execution, Delivery & Process Management

Quarterly

Between 50,000 and 150,000

2,736,648

Quarterly

Less than 10,000

1,061,082

Once in 50 years Total VAR Total Operational Risk Capital (EUR)

Between 50M and 150M

20,000,000

56,097,730 56,097,730

New KRIs and capital adjustment

Business and control environment is reflected in a Scorecard summarizing a set of Key Risk indicators (KRIs). Six months later the relevant Business Units score is rated Very Good. Capital charge is adjusted according to the following formula.

K expS expS K exp1

1.2 1.2

35% 30% 25% 20% 15% 10% 5% 0%

exp2 7.2%
Capital Adjustment = - 7.2%

-5% -10% 1 Very Good Good Medium Bad Very Bad 3

Risk Score

Exponential function limits downside reductions of capital

Results with new KRIs

Questions What is your risk of incurring losses related to Mean frequency Answers (self-assessment) Mean severity (EUR per event) Between 1M and 5M Between 50,000 and 150,000 Worst case (EUR per event) Between 50M and 150M Between 150,000 and 500,000 Between 150,000 and 500,000 Between 50M and 150M

Results
VAR(EUR)

1.Internal Fraud Unauthorized Activity 6. Business disruption and system failures

Once in ten years

32,300,000

Quarterly

2,736,648

7. Execution, Delivery & Process Management

Quarterly

Less than 10,000

1,061,082

Once in 50 years Total VAR Total Operational Risk Capital (EUR) Total Adjusted Operational Risk Capital (EUR)

Between 50M and 150M

20,000,000

56,097,730 56,097,730 52,058,693

Conclusions
Strong top management commitment Analysis of all incidents (and near misses) Risk measurement and management Work with the business units Keep it simple

Any questions? Thank you for attention!