A beginning, not an end...

There's a host of operational risk issues still to be ironed out by the global banking industry and its supervisors. Bank regulator Jeremy Quick considers the key questions.

Operational risk is now on the banking regulator's map - and not before time. But the intention of the Basel Committee of banking supervisors to require international banks - for the first time - to set aside capital against operational risk marks the start rather than the end of a process.

Overall, the hope is that the new Basel accord on bank capital adequacy will be seen as a milestone on the way to a safer banking industry when it takes effect in 2004. It will replace the old accord, which has been in force since 1988.

Few of the committee's proposals for operational risk - defined as "the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events" - should come as a surprise.

For instance, the Financial Services Authority (FSA), Britain's principal financial regulator, has published several documents on operational risk issues on its website. It has also published articles and informally briefed the banking industry on developments in the Basel Committee's thinking.

Yet there is a need to refine further the techniques of measuring operational risk, as proposed in the consultative papers on the new accord published in January. We also need to ensure that the quantitative and qualitative approaches to measuring and managing operational risk work hand in hand.

The operational risk proposals follow the overall three-pillar structure that applies throughout the new accord. Capital charges apply under pillar one, variable capital and other options under pillar two and disclosure under pillar one.

Pillar one
The committee envisages a "continuum" of three stages or approaches towards arriving at a capital charge for operational risk under pillar one, ranging from the simple to the more sophisticated. The more sophisticated the approach, the lower the capital charge.

Stage one - the simplest - is the "basic indicator approach", where the charge would be a percentage of overall gross revenue.

Stage two is the "standardised approach", under which supervisors and banks agree on a series of standardised business lines and indicators. The charge is a percentage of each indicator, with the percentage differing according to business line.

Stage three is the "internal measurement approach", which has the same structure as stage two, but with the key difference that banks could use their own internal operational loss data to help set loss distributions.

In addition to these mechanistic approaches, the committee suggests a series of qualitative criteria for stages two and three.

For stage two, for example, it suggests an independent operational risk management and control process, and specific, documented criteria for mapping current business lines and activities into the standardised framework.

For stage three, the committee wants an operational risk loss database going back a number of years, for instance, and a sound validation process for data generation.

Pillar two
Supervisors intend to supplement pillar one with a more systematic analysis of operational risk, bank by bank, under pillar two. The review will take account of such issues as the general effectiveness of a bank's operational risk control efforts and its procedures for resolving operational risk failures.

It is through pillar two that supervisors will be looking to show that the pillar one measurement techniques are being tied into qualitative identification and control techniques. It should be stressed that this, as much as the new pillar one charge itself, is a key part of the new operational risk framework.

Pillar three
For pillar three, the committee strongly recommends, but does not yet require, greater disclosure of the particular operational risk control mechanisms in place for each bank.

In addition, a bank should disclose its own operational risk exposure by business line and its total operational risk regulatory capital charge. Of course, if a bank is at stage three of pillar one, eventual disclosure of actual loss by business line might be expected.

On the basis of industry consultation, the committee has keyed in a figure of 20% of aggregate regulatory capital as a benchmark figure for the amount of capital that may need to be allocated to operational risk. This figure, of course, will need to be revised subject to further work on calibration, particularly on the basis of operational losses experienced in the banking industry as a whole and by particular banks.

Mitigation of op risk
As time goes by, and as the detailed work is done, we will learn more and more about the causes and mitigation of operational risk. Much of this, of course, will be building on such age-old mitigation instruments as good corporate governance.

But the Basel Committee remains to be convinced about how and whether insurance might be used to reduce the operational risk charge under pillar one. Regulators are concerned, for instance, about the voidability clauses often associated with insurance contracts and the question of how speedily an insurer might pay out in a banking emergency.

Key issues
The banking industry will want to comment on all aspects of the proposals during the consultation period, which lasts until May 31 this year. However, in my view, the following are the key issues:

• Loss categorisation - What is an operational rather than, say, a credit loss? How can direct and indirect losses be distinguished and categorised? What are the parameters for allocating a particular loss by particular business lines and risk types?

• Availability of loss data - This applies to both industry and bank data. The committee can only move as fast as the banks on this. Without calibration by data, a top-down charge is more likely.

• Data in-filling - Some allowance may be made in stage three - the internal measurement approach - for a bank to supplement internal with external loss of data. But on what basis?

• Calibration - This will partly be informed by any results from stage three of pillar one, the internal measurement approach. However, questions here, for example, concern the extent to which expected loss predicts unexpected loss, the extent to which it is possible to 'cap' operational loss in the same way that counterparty loss can be limited, the role and limits of scenario testing, and the basis on which any confidence level should be set. All these issues still need to be clarified.

• Business lines and indicators - These will need to be finalised on a standardised basis and may need to be fully broken down, subject to industry views.

• Pillar two standards for supervisory review - The Basel Committee intends soon to authorise another paper to be published on this.

These issues should provide much material for debate in the three months of the consultative period and beyond.

Jeremy Quick is operational risk manager in the banks and building societies division of the Financial Services Authority, Britain's principal financial regulator.Operational Risk