Public Comment, Supervisory Guidance on AMA for Operational Risk, Risk Management Assn.

Adrie

Le téléchargement nécessite un accès à la bibliothèque YouScribe
Tout savoir sur nos offres

35 pages

English

Le téléchargement nécessite un accès à la bibliothèque YouScribe
Tout savoir sur nos offres

A propos
Informations
Extrait

Description

-zzztrna@ Servrng the Frnanc~ai Services Industry 1801 Market St. Suite 300 Philadelphia, PA 191 03-1628 Telephone 21 5-446-4000 Fax 21 5-446-4101 www.rrnahq.org May 24,2007 Office of the Comptroller of the Currency 250 E. Street, S.W. Mail Stop 1--5 Washington D.C. 2021 9 Jennifer J. Johnson, Secretary Board of Governors of the Federal Reserve System 2oth Street and Constitution Avenue, NW Washington D.C. 2055 1 Robert E. Feldman, Executive Secretary Attention: Comments RIN 3064 - AC73 Federal Deposit Insurance Corporation 550 17" Street, NW Washington D.C. 20429 Regulation Comments Chief Counsel's Off~ce Office of Thrift. Supervision 1700 G. Street, N.W. Washington D.C. 20552 Attention: No. 2007 - 06 Industry Response to Proposed Supervisory Guidance on AMA for Operational Risk and the Supervisory Review Process (Pillar 2) Re: Basel I1 OCC Docket Number 2007-004 FRB OP- 1277 FDIC Re: Basel I1 Supervisorv Guidance OTS No. 2007-06 Ladies and Gentlemen: On behalf of the Advanced Measurement Approaches Group (AMAG)', 1 am writing to convey our industry Group's response to your Proposed Supervisory Guidance on AMA for Operational Risk and the Supervisory Review Process (Pillar 2) Related to Basel I1 Implementation. ' The Advanced Measurement Approaches Group (AMAG) was formed in mid-2005 at the suggestion of the U S. Inter-Agency Working Group on Operarional Rtsk. The AMAG is open to any banking and/or financial institution regulated in ...

Sujets

management

risk management

Informations

Publié par	Adrie
Nombre de lectures	15
Langue	English

Extrait

May 24, 2007

AMAG Response AMAG Response: Proposed Supervisory Guidance for AMA Table of Contents _ Toc167523209 Introduction ...........................................................................................................2 (1) - Contradictory Language ................................................................................2 (2) - Supervisory Objectives and Approach ..........................................................3 (3) - “Systematic Process and “Demonstrate......................................................4 (4) - Internal Controls (S.3) ...................................................................................5 (5) - Board of Directors and Mgt. Oversight Responsibilities (S.4 & S.5) ..............6 (6) - Reporting to the Board (S.10)........................................................................8 (7) Capture and Maintenance of Elements (S.11)...............................................9 -(8) - Historical Observation Period (S.13) ...........................................................10 (9) - Internal Loss Event Data Thresholds (S.16)................................................10 (10) - Internal Loss Event Data (Causal Info Requirement) (S.17) .....................11 (11) - Scenario Analysis (S.20) ...........................................................................11 (12) - BEICF Expectations on ‘Current’ and ‘Comprehensive’ (S.21)..................12 (13) - BEICF Assessments vs. Loss Experience (S.22)......................................13 (14) - Analytical Framework (S.24 & S.25)..........................................................13 (15) Eligible Operational Risk Offsets (S.26) ....................................................15 -(16) - Unit of Measure (S.27) ..............................................................................15 (17) - Accounting for Dependence (S.28) ...........................................................17 (18) - Risk Mitigation (S.29) ................................................................................19 (19) - Documentation of Operational Risk Quant Systems (S.30).......................20 (20) - Validation of AMA System (S.32) ..............................................................20 (21) - Internal Capital Adequacy Assessment Process (ICAAP) .........................21 Attachment A - Summary of Board Responsibilities............................................23 Attachment B - Unit of Measure ..........................................................................25 Attachment C - Dependence...............................................................................28

The Risk Management Association

May 24, 2007

AMAG Response Introduction During the course of the AMAG’s side-by-side comparison of the Proposed Supervisory Guidance released in the Federal Register on February 25, 2007 to its predecessor ANPR Guidance, the Group identified numerous small changes in language from the latter document issued in 2003. The AMAG’s discussions with regulatory Agency representatives prior to release of the NPR Guidance had left the AMAG with the impression that we should not expect major changes. Although a number of the changes identified might fall into the category of clarifications, many others are characteristic of the expansion of rules and lengthening of requirement lists, and in a few cases imperative language references (i.e., “must and “should) were changed. Individually, many of the changes appear minor, but collectively, they have the effect of far more prescriptive Supervisory Guidance overall. Based on our informal Q&A meeting in Washington DC on 4/18/07 with regulatory Agencies (hereinafter referenced as ‘the 4/18/07 meeting’), the AMAG understands that the changes were intended to be a clarification of issues in the SG, and reflective of the long evolution of the NPR. The implication was that the changes were not intended to be major, and Agency representatives suggested that the AMAG highlight changes that it deems to be major and/or problematical in a response to the Supervisory Guidance. As such, in the following Response to the Proposed Guidance, the AMAG highlights instances of contradictory language, as well as major problematical changes in the language since the ANPR Guidance. The primary concern is less about the specific problematical change(s) in each case, but rather the cumulative effect of them. With each incremental regulatory requirement, operational risk management functions become less about managing risk, and more about regulatory compliance. The issues outlined below generally track their order of appearance in the Supervisory Guidance (Federal Register Vol. 72, No.39). Reference pages are cited. AMAG Issue (1) -- Contradictory Language Reference(SG p. 9170) Qualification Requirements, Supervisory Standards: This section of the Guidance includes the statement:"This guidance should not be interpreted as weakening or superseding the safety and soundness principles articulated in existing regulations or guidance issued by the Agencies."

The Risk Management Association

May 24, 2007

AMAG Response Discussion and Implications In the course of reviewing the NPR and Guidance documents, the AMAG identified several instances of potentially contradictory language between the documents. At the 4/18/07 meeting, the Agencies indicated that it had been their goal to be as consistent with the NPR as possible. They indicated that they appreciated receiving the AMAG’s Unit of Measure example and requested that the AMAG provide any others that it might have identified. As such, the following illustrative examples are provided: oThe detailed text for Standard No. 17 states: The bank’s operational loss policies and procedures should consider the effect and treatment of operational loss events that are recovered within a short period of time. See our discussion for AMAG issue number 10, which addresses SG Standard 17, on pp.11-12, below. oUnit of Measure: The AMAG has provided an excerpt of its response to the NPR on Unit of Measure, which provides an example of contradictory language (see Attachment A). Suggestions With reference to the examples identified: oOperational Loss policies and procedures: Standard 17 - The AMAG requests that this last sentence be removed from the Guidance. oUnit of Measure: The AMAG reiterates the position taken in its NPR response in AMAG issue # 17, below and outlined completely in Attachment A. AMAG Issue (2) -- Supervisory Objectives and Approach Reference(SG p. 9171) The Guidance states that“In performing their evaluation, the Agencies will exercise supervisory judgment in evaluating both the individual components and the overall AMA System. The NPR provides that the primary Federal supervisor may require a bank to assign a different risk-weighted asset amount for operational risk, to change aspects of its operational risk analytical framework (for example, distributional or dependence assumption), or to make other changes to the bank’s operational risk management processes, data and assessment systems, or quantification systems if the supervisor determines that the risk-weighted asset amount for operational risk produced by the bank is not commensurate with the bank’s operational risk profile.

The Risk Management Association

May 24, 2007

AMAG Response Discussion and Implications The AMAG does not dispute that a primary supervisor has the option of requiring a different risk-weighted asset amount for operational risk. The specific changes to a bank’s operational risk analytical framework, processes and systems referenced in the text, however, would be extremely disruptive. The full implementation of a bank's AMA System may take years. Once set in place, and approved during the Qualification phase, a bank cannot easily change components of its analytical framework, process and/or systems, nor should it be expected to. The AMAG understands that this section was intended to be more or less based on traditional language used by the Agencies in NPR’s. Based on our exchange on this topic at the 4/18/07 meeting it was the AMAG’s sense that the Agencies’ primary concern is not so much an interest in changing aspects of an operational risk analytical framework, but rather to confirm that “capital is reflective of risk. One representative asked whether the AMAG would be more comfortable if the Agencies removed the language about making changes to the analytical framework. Suggestions First, the AMAG believes that changes that a bank's primary supervisory feels are warranted, to ensure the risk-weighted asset amount produced by the bank is commensurate with the bank's operational risk profile, should be limited to Pillar 2 Second, the AMAG requests deletion of the following language: “ to change aspects of its operational risk analytical framework (for example, distributional or dependence assumption), or to make other changes to the bank’s operational risk management processes, data and assessment systems, or quantification systems Third, the AMAG requests that the words “and apply benchmarks be inserted before the words“in evaluating bothand the words “and indicate what benchmarks had been applied after the words“ a difference risk-weighted asset amount for operational risk. AMAG Issue (3) -- “Systematic Process and “Demonstrate Reference The words “systematic process and/or “demonstrate are used throughout the Supervisory Guidance. “Systematic process is used in Standards 11, 13, 18, 20, as well as in the supporting text for S. 20 and in the definition of Scenario Analysis. Demonstrate is used in supporting text and/or Standards 4, 5, 13-17, 23-25, 26, 28, 29, 30, as well as in the supporting text for Qualification Requirements and ICAAP.

The Risk Management Association

May 24, 2007

AMAG Response Discussion and Implications Although the AMAG concurs with the need for rigor in capital estimation, it is also very concerned about the potential interpretation of these terms. If interpreted in the most conservative sense, these words can suggest a level of rigor and/or maturity of the operational risk discipline beyond its actual stage in the evolutionary path. For example, “to demonstrate could entail proving and providing clear and certain evidence. Operational risk measurement and management is still evolving and, in many cases, the best that can be reasonably achieved at this time is well reasoned, thoughtful and well-documented consideration, rather than a “demonstration. It is important that reasonability be incorporated into the implementation of the AMA in the U.S., to reflect the complexity involved, stage of development, and the qualitative judgment necessary in a number of areas. The AMAG believes that a practical implementation of Pillar I can serve as a catalyst for the development of operational risk management and measurement practices. Over time, this could lead to more consistency, greater transparency, comparability between institutions, improved disclosure, and more effective industry practice. Initially setting the bar beyond what is currently feasible, however, could lead to undesirable outcomes and/or unintended consequences. Suggestions The AMAG has attempted to cite the use of “systematic process and “demonstrate throughout this Response, along with requested replacements. Whether or not cited, however, the AMAG requests use of different terminology that would be more consistent with the state of operational risk management development, such as use of a term such as a (e.g., “thoughtful procedure instead of “systematic process or “explain and document instead of “demonstrate). Alternatively, the terms “systematic process and “demonstrate could be defined in the text to interject a reasonableness test. AMAG Issue (4) -- Internal Controls (S.3) Reference(SG pp. 9172-9173) Standard No. 3 states“The bank must maintain effective internal controls supporting its AMA System. The supporting text requires that internal audit assess the effectiveness of internal controls annually, continuing with annually for assessed“Sound internal controls, effectiveness by internal audit, should also reduce the possibility of significant human errors and irregularities in internal processes and systems, and should assist in their timely detection when they do occur. The audit function’s annual assessment is not required to assess all operational risk controls, but the scope of the assessment should be sufficient to assess the effectiveness of the controls supporting the bank’s AMA System. (Emphasis added)

The Risk Management Association

May 24, 2007

AMAG Response Discussion and Implications The effectiveness of controls is assessed by internal audit on an ongoing basis and reported to senior management, based on approved audit plans. The requirement for a specific annual assessment of controls supporting the AMA system would be burdensome, with no discernible benefit. Suggestions The audit review schedule should be risk-based and may occur more or less frequently than annually, as appropriate to the risk. The AMAG requests that the word “annually be replaced by “periodically, as appropriate, given a risk-based schedule. AMAG Issue (5) - Board of Directors and Mgt. Oversight Responsibilities (S.4 and S.5) Two standards in the Guidance refer to Board of Directors and Management oversight. We include them here as AMAG issues 5 (a) and 5 (b), below. 5 (a) Annual Evaluation of the Bank s AMA System ’ Reference(SG p. 9173) Standard No. 4 states “The board of directors must at least annually evaluate the effectiveness of, and approve, the bank’s AMA System, including the strength of the bank’s internal control infrastructure. (AMA System is defined to mean a bank’s “advanced operational risk management processes, operational risk data and assessment systems, and operational risk quantification systems) .(Emphasis added) Among other specifics referenced in the detailed text, additional language continues with: “Information provided to the board of directors for the AMA review should be detailed enough for the bank’s board members to understand and evaluate its AMA system(sources of information are outlined in SG footnote #11.) (Emphasis added) 5 (b) Ensure Integration of the AMA System Reference(SG p. 9173) Standard No. 5 states“The board of directors and management should ensure the AMA System (defined above) is appropriately integrated into the bank’s existing risk management and decision-making processes and that there are adequate resources to support these processes throughout the bank.(Emphasis added)

The Risk Management Association