Inception Banking Definition

[Dona Vansoest]

Thesite is secure.

The ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

The FDIC provides a wealth of resources for consumers, bankers, analysts, and other stakeholders. Browse our collection of financial education materials, data tools, documentation of laws and regulations, information on important initiatives, and more.

The FDIC is proud to be a pre-eminent source of U.S. banking industry research, including quarterly banking profiles, working papers, and state banking performance data. Browse our extensive research tools and reports.

The FDIC publishes regular updates on news and activities. Keep up with FDIC announcements, read speeches and testimony on the latest banking issues, learn about policy changes for banks, and get the details on upcoming conferences and events.

Operational risk is not a new concept in the banking industry. Risks associated with operational failures stemming from events such as processing errors, internal and external fraud, legal claims, and business disruptions have existed at financial institutions since the inception of banking. As this article will discuss, one of the great challenges in systematically managing these types of risks is that operational losses can be quite diverse in their nature and highly unpredictable in their overall financial impact.

Banks have traditionally relied on appropriate internal processes, audit programs, insurance protection, and other risk management tools to counteract various aspects of operational risk. These tools remain of paramount importance; however, growing complexity in the banking industry, several large and widely publicized operational losses in recent years, and a changing regulatory capital regime have prompted both banks and banking supervisors to increasingly view operational risk management (ORM) as an evolving discipline. Of particular note is the application of quantitative concepts, similar to those used to measure credit and market risks, to the measurement of operational risk.

The definition of operational risk continues to evolve, in part owing to its scope. Before attempting to define the term, it is essential to understand that operational risk is present in all activities of an organization. As a result, some of the earliest practitioners defined operational risk as every risk source that lies outside the areas covered by market risk and credit risk. But this definition of operational risk includes several other risks (such as interest rate, liquidity, and strategic risk) that banks manage and does not lend itself to the management of operational risk per se. As part of the revised Basel framework,1 the Basel Committee on Banking Supervision set forth the following definition:

While the Basel Committee's definition includes what the Committee considers to be crucial elements, each bank's definition for internal management purposes should recognize its unique risk characteristics, including its size and sophistication, as well as the nature and complexity of its products and activities. In cooperation with industry participants, the Basel Committee has identified the seven operational risk event types, shown in Table 1.2

The operational environment for many banks has evolved dramatically in recent years. Deregulation and globalization of financial services, the proliferation of new and highly complex products, large-scale acquisitions and mergers, and greater use of outsourcing arrangements have led to increased operational risk profiles for many institutions. Technological advances, including growth in e-banking transactions, automation, and other related business applications also present new and potentially heightened exposures from an operational risk standpoint.

Available data support the idea that banks' operational environments are getting riskier. Chart 1 depicts data gleaned from the 2004 Loss Data Collection Exercise (LDCE)3 conducted in preparation for the U.S. implementation of the Basel II capital framework. Despite certain inherent limitations in the data, such as differences in data availability among the reporting banks and improvements in data capture methods over the collection period, it appears that in aggregate loss amounts have increased since collection efforts began. For example, 20 participating banks reported operational losses of $15 billion in 2004, surpassing the previous high of $5 billion in losses reported by 17 institutions in 2002.

Losses associated with operational risk events can be large. Some well-known examples are the collapse of Barings Bank due to fraudulent trading and the substantial legal settlements entered into by Citigroup and JPMorgan Chase with regard to the Enron and WorldCom matters. The business disruptions and financial impacts resulting from Hurricane Katrina and the September 11 terrorist attacks also exemplify how major, unforeseen events can materially affect a bank's operations.

Traditional ORM practices, which most banks employ today, rely on internal processes, audit programs, and insurance protection to counterbalance operational risk. They are based largely on the assumption that intelligent, educated people can, through their intuition, identify their organization's significant risks, corresponding controls, and associated metrics.4 In such environments, business lines manage their operational risks as they see fit (using a "silo approach") with little or no formality or process transparency.

Some larger banks have gone beyond the silo approach by establishing centralized departments or groups responsible for focusing on particular segments of operational risk, such as operating processes, compliance, fraud, business continuity, or vendor management/ outsourcing. While this evolution has improved overall risk awareness, it tends to promote a natural segmentation of risk awareness, because risks are categorized along functional lines. This approach can create significant operational risks if management fails to consider end-to-end processes.5

More recent ORM practices are founded on the view that intuition alone is not sufficient to drive the ORM process. In this view, ORM practices must extend to quantitative measurement, including historical loss data, formal risk assessments, statistical analysis, and independent evaluation.6

A common framework at the largest U.S. banks combines the traditional silo approach with an enterprise-wide oversight function. The enterprise-wide (or corporate) function designs and implements the bank's ORM framework, which serves as the structure to identify, measure, monitor, and control or mitigate operational risk. The framework is defined by the risk tolerance determined by the board of directors, as well as the formal operational risk policies outlining roles and responsibilities, data standards, risk assessment processes, reporting standards, and a quantification methodology.7 Business line managers continue to "own the risk," but risks are identified through formal self-assessments. The risk assessments are designed to capture end-to-end processes as well as generate an understanding of the risks in individual processes and products. Table 2 compares the two approaches to ORM.

The primary value of such ORM techniques, as demonstrated by a growing number of institutions using them, is their application to decision making and risk management. Specifically, the use of a well-integrated ORM framework can do the following:

As ORM continues to evolve into a distinct discipline, efforts to quantify operational risk have gained momentum. A number of large financial institutions have been working to quantify operational risk for several years as part of their economic capital frameworks. They have developed and implemented economic capital models to allocate capital to different business segments based on a variety of risk factors (e.g., credit, market, interest rate, operational). However, within these internal capital measurement and management processes, there is great variation in methods used and levels of sophistication, ranging from largely qualitative or judgmental approaches to complex statistical modeling. With respect to operational risk, in particular, many of the measurement techniques have traditionally focused on proxies such as gross income to estimate capital allocations.

While few institutions have incorporated operational risk quantification systems into their economic capital models, ongoing work in this area is becoming increasingly important given the anticipated implementation of a new regulatory capital framework known as Basel II. This new framework, which has been under development since the late 1990s and is approaching international adoption, is intended to align capital levels more closely with underlying risks. This general intention is consistent with the broad goal of most economic capital frameworks.

Under the Basel II framework, institutions (both mandatory and opt-in)9 will be required to determine an appropriate operational risk charge, along with credit and market risk charges, as part of their risk-weighted assets (RWA) calculation. Each institution's estimate of its operational risk exposure will, subject to supervisory approval, directly affect its risk-based capital (RBC) ratio.

Under the existing regulatory capital regime (Basel I), which was adopted in 1988, there is no explicit charge for operational risk. In determining RBC ratios, financial institutions calculate RWA on the basis of prescribed percentage allocations for on- and off-balance sheet credit exposures and for certain market risks. It could be argued that operational risk and other risks were implicitly accounted for in the calibration of the minimum ratio thresholds for the various Prompt Correction Action categories10 (e.g., 4 percent Tier 1 capital to average adjusted balance sheet assets for the "Adequately Capitalized" designation), but they are not considered in determining a bank's capital ratios.

3a8082e126