Correlation: Alternative realities

Correlation - it seems you either love it or you hate it. And whatever stance you take, there's bound to be a good argument to back it up. So it's up to the banks to decide whether or not it provides value in their capital-reduction process. Duncan Wood surveys the industry on this divisive issue

For a discipline rooted in statistics and maths, op risk modelling is disturbingly prone to arguments about whether the earth is flat or round. The current bone of contention is correlation. The Basel Accord gives advanced measurement approach (AMA) banks the option to reduce their capital if they can prove to regulators there is a diversification benefit across the various risks the organisation faces. Some banks and consultants say correlation can be measured precisely and could result in a reduction of up to 40% in capital - everyone should be doing it, they claim. Others argue correlation can't be measured cleanly and the benefit is, in any case, minimal - it's a waste of time, they protest. Banks now need to choose which version of reality to believe.

One institution to have taken the plunge is BBVA. The bank uses software developed by Quantitative Risk Research, a spin-off of Universidad Autonoma de Madrid led by professor of mathematics Santiago Carrillo, to calculate its op risk capital requirements, including correlation. The resulting number is 48% lower than if BBVA used Basel's standardised approach, says Jordi Garcia, the bank's global head of operational risk. If the bank used the AMA but did not apply correlation, the standardised approach would produce capital that is 2% lower, he says - in other words, the time and money spent on achieving the AMA will only earn a return in the form of capital relief if the bank takes an extra step and satisfies the regulators it can understand and measure correlation.

"Other banks are getting similar results," he says. "There is not much of a saving in the AMA approach if you don't apply correlation, and the real saving is when you do apply correlation. That is the reality."

The argument behind it is fairly simple. Banks have a number of different business lines, each of which is more or less exposed to Basel's seven categories of op risk event. This produces a matrix of cells, corresponding to the risk of a given event hitting a given business line - internal fraud in retail banking, for example, or systems failure in investment banking. To qualify for the AMA, banks have to fill in their risk matrix, working out probability and severity for every cell - and then add up the capital that would be needed to survive each of them.

The result is a capital buffer that, in theory, covers all of a bank's risks. In reality, that capital number is far too pessimistic, says Man Cheung, head of the modelling, analysis and design team at risk adviser Marsh in London. "The operational risk space covers a wide gamut of things, from rogue trading all the way through to terrorist attacks, natural catastrophes, pandemics, IT failures, employer liability and public liability. These are diverse events and the risks in many cases are totally independent of each other," he says.

BBVA's Garcia puts it a little differently: "Your retail banking business might suffer a big fraud, but retail banking has nothing to do with an earthquake in Mexico. All of the banks are finding low correlation between their risk types - and this is logical, it makes sense."

Of course, some of the risks are correlated to some extent: a systems failure in one business might result in a fraud in the same area, for example. So, banks have the option to work out the degree of correlation between the cells in their matrix and then try to convince regulators their risk profile is lower than it appears if the risks are simply stacked on top of each other. A correlation estimate of 0% means the risks are uncorrelated - one event has no bearing on whether the other event will happen - while an estimate of 100% denotes perfect correlation, meaning the two risks march in lockstep: when one happens, the other will happen as well.

According to BBVA's Garcia, the correlation values in the bank's matrix range from a high of 17% to a low of -15%, with a weighted average of just less than 15%. Negative correlation means one event happening will lower the probability of another, different loss occurring. The highest correlations at BBVA are between process execution in retail banking and the same event in commercial banking. Similarly, there is a high correlation between internal fraud in retail banking and commercial banking. Within retail banking, there is also a high correlation between internal fraud and process execution, says Garcia.

But even when correlations are high, it doesn't necessarily translate into high capital requirements, says the University of Madrid's Carrillo. The common-sense explanation is that, just because systems failures and frauds happen at the same time (for example) it doesn't necessarily mean the losses involved are big. "When severities are independent, even a high correlation in frequencies will imply low correlation in the aggregate losses. The interesting consequence is that there's a lot of opportunity to combine prudential regulation and lower capital numbers," he says.

But is there? A very different take is provided by Kabir Dutta, a former senior economist at the Boston Fed who now works as a senior consultant for CRA International. He argues that, because only a fraction of capital is held for each individual loss event (proportional to the chance of it happening and the probable size of the loss) a bank might only have enough capital to protect itself against a single big event anyway. So any diversification benefit is practically irrelevant.

To illustrate, he sketches out a simple example in which a bank holds $1 million of capital to cover the risk of loss to one business unit, and $2 million of capital to cover a second unit. Under the AMA, banks have to add the two together, if they can't prove the existence of diversification by suitable modelling, resulting in a $3 million buffer for both units. The diversification argument says that $3 million is too much because both units are unlikely to suffer enough losses to justify that kind of cushion - instead, a bank might argue that $1.5 million will do. Dutta says that would be way too much.

"Even if you go to the extreme of assuming that the events are completely randomised and there is zero correlation between them, the capital number would still be very close to $3 million. The full extent of the diversification benefit might get you to $2.7 million or $2.8 million - and I've seen this in my own research and in the work I've done with many financial institutions," he says.

It might seem counterintuitive, but Dutta insists that, although correlation might well be low for bank op risk events, just a single serious loss would be enough to account for the vast majority of the regulatory capital anyway, also known as one loss ruin problem, so the savings from diversification are slender. As a result, Dutta has been advising his clients to focus on understanding their individual risks and then just add up the resulting capital. "They always think this represents a worst-case capital level, but then I show them their best case - the two are very close. Trying to work out correlation is a complete waste of time and is only going to result in closer regulatory scrutiny," he says.

But other consultants are offering different advice, and coming up with different numbers. Paul Search, head of the op risk team within Marsh's financial services consulting practice in London, says the capital savings from correlation would typically be well in excess of 20%. He estimates that the firm has worked with about a dozen banks globally who are spending some time looking at correlation. "Quite a few people have gone through the process. Some have made a formal application to the regulator, others haven't. The benefits can be quite substantial."

Regulators accept that the difference could be material. Patrick de Fontnouvelle, head of quantitative analysis at the Boston Fed, says adding up the capital associated with individual risks "is intended to be - and is, in fact - a conservative approach. The diversification benefit could be substantial". Across the Atlantic, Andrew Sheen, manager of the operational risk review team at the Financial Services Authority (FSA) in London, echoes that. "The argument is that the uncorrelated capital number doesn't accurately reflect the firm's risk. The difference between that and a number that takes account of correlation could be pretty significant."

The FSA has already agreed to allow two of its AMA-approved banks to recognise some diversification benefits - Lloyds and Barclays. Lloyds is currently merging with HBOS and declined to comment for this article - HBOS is also an AMA bank, but it doesn't have approval to use correlation. Other regulators in Germany, France and Australia are also believed to either be considering applications to use correlation or to have handed out some approvals already.

While regulators accept the theoretical argument in favour of diversification, they still need to be convinced that an individual bank can calculate the impact reliably - at the same 99.9% confidence level required for capital calculations already. "It's not trivial," says Gerald Sampson, manager of the operational risk review team at the FSA in London. "Correlation is something that is measurable over history - and history is something that most firms don't have a whole lot of. Typically, they have loss history and experience of between five and seven years. That makes it difficult for them to measure how one risk moves in lockstep, or doesn't move in lockstep, with another risk type, and similarly for business units. So right there you have a bit of a handicap."

Gez Llanaj, business development director at SAS Risk Intelligence, suggests that, as a rule of thumb, if a bank wanted to use data alone to calculate monthly correlation, it would need at least a full decade of loss history. There are other practical problems as well, says CRA International's Dutta - because banks are looking for instances where events have happened at the same time, their data has to be recorded in such a way that the times are comparable. If one event happened on a Tuesday morning and another happened the following Thursday afternoon, is that evidence of correlation? As such, many firms bracket their losses by the week or the month - grouping them in a way that increases the chance of finding evidence of correlation - but even here there are problems with the precision of the loss history. "When a bank suffers a loss event, it might not be recognised and recorded immediately - what's more likely is that it will spotted some time later, handed to a data clerk, and entered into the system at the end of that week, that month - who knows? It's not like stock market data, moving tick by tick - there just is no precision here," he says.

There are also issues with the categorisation of losses, says Dutta - he illustrates with a hypothetical scenario in which a systems failure leads to an instance of external fraud: a prima facie example of correlation. But because the loss will tend to be sustained through the fraud rather than the systems failure, the event might end up just being recorded as a fraud, with the causal event missing from the historical record completely. In conclusion, he says, banks don't have the data to calculate correlation.

As a result, many institutions - including BBVA - are supplementing their data with subjective assessments of correlation, which have become part of the scenario analysis process. "One way in which correlation estimates can be made more robust is by mixing together data and expert opinion, using both to help test and shape a final estimate," says SAS Risk Intelligence's Llanaj. This makes one European regulator a little nervous: "There seems to be enough data to say something meaningful about correlations. But that is different from saying that you can pin it down at 27% or whatever the number is. Using some element of expert judgement to strengthen that is fine, but data still needs to inform the discussion - we don't want someone holding their finger in the air and then saying 'well, we think there is a 10% correlation'," he says.

He stresses that correlation estimates should be treated conservatively. The precise wording in the Capital Requirements Directive, which translates the Basel Accord into European Union law, states that banks should "take into account the uncertainty surrounding correlation estimates, particularly in periods of stress". What that means is that if "your data analysis is telling you that correlation looks like 20% but it could really be anywhere between 5% and 40%, then you would err on the side of higher than 20% just to reflect the imprecision of what you know," the regulator says.

BBVA's Garcia responds: "Regulators around the world obviously have big concerns about capital going down but there is the possibility to be extremely conservative and still see lower numbers - we see it as a big positive," he says.

But even after the technical and mathematical issues with correlation have been squared away, there are other objections - mostly rooted in the idea that it is inappropriate to be talking about using sophisticated modelling to reduce capital during a financial crisis. "It is pretty bad timing," one regulator dryly observes.

In fact, even within some banks, the argument in favour of using correlation might be getting short shrift right now. Jennifer Moodie, head of operational risk at Business Control Solutions, says: "The central op risk function in a lot of big institutions has a poor reputation right now because of this focus on modelling, which is a long way removed from the practical management of operational risk."

Moodie herself has been forced on more than one occasion to point out she's not interested in modelling op risk to get time with chief operating officers at large UK banks. "They are fed up with the quants and the AMA calculations. Until I explain that I'm not one of these people and I actually focus on improving business practices, they won't speak to me."

Marsh's Search says that the current environment and the uncertainty around correlation is being taken into account by some banks, who might run their correlation estimates alongside their uncorrelated Basel capital numbers for a year to see how they stack up - rather than going immediately to the regulator and asking for permission to start recognising the benefit. Other banks are skipping the issue entirely for now, says CRA International's Dutta: "There are one or two institutions in the US who claim they can see some diversification but a lot of my clients are staying away from this and just deciding to add up the capital."

The Gaussian copula

Most op risk correlation models rest on a formula known as a copula. There are many different varieties - but one in particular, the Gaussian, has recently gained an unenviable reputation because of its widespread use in the structured credit market, where it contributed to a systemic mis-pricing of risk. Earlier this year, one mainstream magazine ran a cover story calling it "the formula that killed Wall Street".

In June 2007, the UK Financial Services Authority (FSA) published a paper warning banks against using the Gaussian copula - and others that have similar characteristics - to drive op risk correlation estimates. "The Gaussian copula has asymptotically nil tail dependency, which basically means that whatever amount of correlation coefficient you put into it, it tends to evaporate as you get closer to the probability of one. So, by the time you reach the 99.9% percentile, the effect of a Gaussian copula is actually quite weak whereas other copulas, such as the t-copula - although there are others - preserve the effects of correlation better and longer," says Gerald Sampson, manager of the op risk review team at the FSA.

So, which copula should banks use? BBVA's software gives it the ability to produce correlation estimates using any one of three copulas: the Gaussian and the t-copula are both included. "The difference in the results is not significant in the data I have seen to date," says Santiago Carrillo, professor of mathematics at Universidad Autonoma de Madrid.

Others argue this can of worms is better left unopened. Kabir Dutta, a senior consultant at CRA International in Boston, says: "It is just another mess on top of the existing mess that faces the market in terms of what severity distribution they use. Even today there are a lot of questions out there - and now we are talking about introducing a further choice between a range of multi-dimensional copulas. It is distracting people from getting the fundamentals right. What we need is lots of quality research work to justify the use of some concepts and methods before arbitrarily borrowing from other disciplines."