Basel II - Operational Risk - AMA

Basel II Operational Risk AMA
INTRODUCTION
SLIDE 2
Advanced Measurement Approaches (AMAs) for operational risk are the subject matter of this tutorial. The AMA is one of three methods of increasing sophistication and risk sensitivity for calculating operational risk capital charges that the Basel II framework presents.
The other methods are the: Basic Indicator Approach (BIA) Standardized Approach (SA)
These other methods can be studied in the tutorial: Basel II Operational Risk BIA & SA. A bank's risk profile, particularly its operational risk profile, should be a key factor in determining the method used to measure the extent of its exposure to operational risk.
The measurement and management of operational risk as a distinct risk is a relatively recent phenomenon. As a result, the development of internal operational risk measurement methods by banks is still in relatively early stages, with much work still under way. At present, there is no one measurement methodology generally recognized within the banking industry.
The internal methods currently in use by banks vary extensively, primarily because banks' circumstances and operational risk profiles are very different. It is expected that banks will

continue to develop and refine methods as their experience grows and the discipline matures.
OBJECTIVES
On completion of this tutorial, you will be able to: describe what is meant by Advanced Measurement Approaches (AMAs) for operational risk list the qualitative and quantitative conditions for the use of an AMA define the key features of an Operational Risk Measurement System (ORMS) describe the range of AMAs in use explain the risk mitigating impact of insurance on capital requirements for operational risk describe the implementation and transitional issues relating to AMAs
SLIDE 3
Prerequisite Knowledge To get the maximum benefit from this tutorial, you should be familiar with the Basel II capital adequacy framework and the fundamentals of operational risk. You can study these concepts in the following tutorials: Basel II An Overview Operational Risk An Introduction Operational Risk Management Sound Practices Basel II Operational Risk BIA & SA
SLIDE 4
KNOWLEDGE CHECK
Take the Knowledge Check to see how much you already know about AMAs for operational risk. This short quiz (six questions) introduces you to some of the subjects that are presented in this tutorial.
It will also help you identify any gaps in your knowledge, although you may find you know more than you thought!

Keep in mind that answering each question correctly is no guarantee you know everything covered in this tutorial.
SLIDE
1. What types of banking groups are likely to use an AMA to determine capital requirements for operational risk?
Large banking groups that are broadly diversified in terms of business activities and operate in many different countries around the world Highly specialized banks whose activities involve a high daily volume of transactions Small banks that do not aspire to using their internal rating systems for determining capital requirements for their credit risk exposures A bank that is a small subsidiary of a banking group located in another country whose banking supervisors are not expected to approve the use of AMA by their banks
2. What do you think are the Basel II objectives for setting out supervisory standards relative to the use of an AMA for operational risk?
SLIDE 6
To ensure that banks internal methods result in credible levels of capital for operational risk To encourage banks to work together to develop similar approaches and uniform techniques to measure operational risk To provide incentives to banks for developing operational risk measurement methods that capture all material elements of operational risk
3. Which of the following statements relating to key features of an internal Operational Risk Measurement System (ORMS) are true and which are false? A bank must collect internal loss data, by type of loss events, as a basis for its AMA.
SLIDE 7

External data is particularly relevant for types of loss that are frequent and of low severity. External operational risk loss data is seen primarily as a means for supervisors to verify that a banks internal data is credible and reasonable. An ORMS needs to incorporate scenario analysis based on not only internal, but also external, loss data as one of its integral parts.
4. True or False?
SLIDE 8
To meet the requirements of Basel II, a bank's AMA cannot incorporate aspects of both the Loss Distribution Approach (LDA) and the Scenario-based Approach (SBA).
An AMA can incorporate externally generated loss data provided a system of adjustment is put in place to reflect the circumstances of the banking group. Where a banking groups internal loss data is comprehensive and extends to more than five years of history, it is not necessary to perform scenario analysis as part of its AMA for operational risk.
An AMA should estimate the aggregate operational risk loss that it faces over a oneyear period at a soundness standard consistent with the standard applicable for credit risk.
5. Which of the following mitigants are recognized under Basel II for operational risk? Collateral Guarantees Operational risk derivatives Insurance provided by regulated insurers Insurance provided by highly rated insurers, provided specified criteria are met
SLIDE 9
6. Which of the following are among the conditions that must be met before an AMA
SLIDE

bank can allocate a portion of its group-wide AMA capital to one of its foreign subsidiaries for the purpose of determining the subsidiary's standalone operational risk capital requirement? The allocation mechanism has been approved by the host supervisor and is supported by the home supervisor. The foreign subsidiary is considered significant relative to the size of the overall banking group. The foreign subsidiary is subject to Basel II on a standalone basis in the jurisdiction where it operates.
10
COMMUNICATE
SLIDE 11
Once you have completed this topic, you will be able to outline some of the key concepts related to Basel IIs Advanced Measurement Approaches (AMAs) for operational risk.
In particular, you will learn about:
what Basel II means by an AMA for operational risk options for implementing an AMA in a banking group, including partial use the issues arising from the flexibility that Basel II allows for the development of AMA
AMA Application within a Banking Group
SLIDE
5

12
What is an AMA?
An AMA is a bank-specific internal method for: identifying, assessing and quantifying operational risk exposure, as defined by Basel II calculating regulatory capital requirements
Banks with significant operational risk exposures, including specialized processing banks, are expected to use an approach that is: more sophisticated than the Basic Indicator Approach (BIA) appropriate for the risk profile of the institution
The AMA capital requirement for operational risk is based on the measure of operational risk exposure generated by a bank's internal measurement system for operational risk. The use of an AMA by a bank is subject to supervisory approval.
SLIDE
AMA Application
13
An AMA is generally expected to be a group-wide method for capturing all material operational risk at all levels within a banking group. There are circumstances, however, under which it may be impractical for cost or logistical reasons to implement an AMA that is truly group-wide. For example, the activities of a banking subsidiary located in a different jurisdiction than the group parent could have unique operational risk characteristics not found elsewhere in the group. Where the subsidiary's activities and related operational risk profile are immaterial relative to those of the rest of the group, the cost of implementing the necessary practices and procedures in the subsidiary so that its activities are reflected in the group-wide AMA could be difficult to justify in relation to the benefits. Consequently, such risks may not be adequately reflected in an AMA developed with the bank's groupwide operational risk profile in mind. It is largely for this reason that Basel II allows for 'partial use' of the AMA.
SLIDE
Partial Use of AMA
14
Subject to the approval of its supervisor, a bank can use an AMA for some parts of its operations and the BIA or Standardised Approach (SA) for others. Partial use can apply on a transitional basis, recognizing that it may be difficult for a bank to roll out an AMA across all of its operations at the same time, or on a permanent basis. When partial use of an AMA is employed, the group-wide operational risk capital requirement is equal to the sum of: the capital required under the AMA for those parts of the group that are captured by the AMA the capital required under the BIA or SA for the parts that use these approaches
There are a number of conditions a bank must meet before it can use an AMA on a partial basis.
Conditions for Partial Use In order to make partial use of an AMA, a bank must meet all of the following conditions: All operational risks of the bank's global, consolidated operations must be captured. All of the bank's operations that are covered by the AMA must meet the qualitative criteria for using an AMA. The parts of the bank's operations that are using one of the simpler approaches must meet the qualifying criteria for that approach. When the AMA is implemented, the AMA must capture a significant part of the bank's operational risks. The bank must have a plan that sets the timetable for implementing the AMA across the remainder of the group. Once the implementation plan is completed, all but an immaterial part of the bank's operations must be captured by the AMA. The bank's plan
SLIDE 15

for extending the use of the AMA across all the bank's operations should not be influenced by incentives to hold lesser amounts of capital. Immaterial operations should only be excluded if it is not feasible or practical to move them to the AMA over time.
AMA Partial Use Exceptional Approvals

You have learned that a banking group can make partial use of a group-wide AMA, provided it meets a number of conditions. Let's look at a bank that does not intend to implement the AMA on a group-wide, consolidated basis, but would rather use a simpler approach. In limited circumstances, the supervisor may allow the bank to use an AMA on a permanent basis for a part of its operations even if the AMA does not capture a significant part of the bank's groupwide operations and the bank has no intention to roll out the AMA to all but an immaterial part of its operations. In general, such approvals should be granted only where a bank has a subsidiary operating in a foreign jurisdiction that is required by the host supervisor to adopt an AMA for that subsidiary, that is, the only reason the bank is unable to meet all of the partial use conditions is a decision by the supervisor of one of its foreign subsidiaries. In such a case, the bank would include in its group-wide, consolidated operational risk capital requirements the results of an AMA calculation at the subsidiary. This AMA must be approved by the relevant host supervisor and must also be acceptable to the bank's home supervisor.
Flexibility and the Bank

SLIDE 16
Under the Basel II AMA approach, a bank has considerable flexibility in developing and using its own methodology for calculating its risk-based capital requirement for operational risk.
The flexibility provided by the use of internal methods is intended to encourage banks to:

develop systems that are responsive to their own risk profiles improve their risk management practices
At the same time, the Basel Committee recognizes the need to ensure that: the use of different internal methods delivers an appropriate degree of credibility and reliability in terms of capital held for operational risk there is a common set of standards for the use of AMAs, so that different banks adopting different methodologies for assessing operational risk have consistent results in terms of capital held for similar levels of operational risk
SLIDE 17
Flexibility and the Supervisor

Providing flexibility for banks to use their own methods can place a considerable burden on you as a supervisor. This is most apparent when you are assessing different banks' approaches to operational risk. This flexibility also makes it more difficult for you to make comparisons between banks than if a common, more prescriptive approach is specified.
To address these issues, the Basel Committee has developed both qualitative and quantitative supervisory standards. These standards, which are discussed in the next topic, will provide supervisors and banks with some assurance that all banks using internal measurement systems are subject to similar expectations.

Partial Use Identify one of the conditions a bank must meet in order to make partial use of an AMA. At least 50% of a banks operations that are covered by the AMA must meet the qualitative criteria for using an AMA. In order for a supervisor to approve the use of an AMA, a timetable must show that the AMA will capture all operational risk within a year. The bank's AMA must capture all material operational risk of its group-wide, consolidated operations.
SLIDE 18
To sum up
An Advanced Measuring System Approach (AMA) is a bank-specific internal method under the Basel II for identifying, assessing and quantifying operational risk and calculating the related regulatory capital requirements. Banks with significant operational risk exposure are expected to use an approach that is more sophisticated than the Basic Indicator Approach, such as an AMA. The use of an AMA by a bank is subject to supervisory approval.
SLIDE 19
An AMA is generally expected to be a group-wide method that captures all material operational risk at all levels within a banking group. There are circumstances, however, under which it may be impractical for cost or logical reasons to implement an AMA that is truly group-wide. For this reason, Basel II allows for partial use of an AMA on a transitional or permanent basis for banks that meet prescribed conditions.
Basel II allows banks considerable flexibility in the design of an AMA. As a result of this flexibility, AMAs can look very different from bank to bank.
AMA SUPERVISORY STANDARDS

Once you have completed this topic, you wil be able to describe the supervisory standards that
SLIDE 20
10

a bank must meet before it will be permitted to use its AMA for regulatory capital purposes. Under Basel II, the use of an AMA is subject to supervisory approval.
In particular, you will look at the: general and specific qualitative standards quantitative standards
I. The Purpose of AMA Supervisory Standards
SLIDE 21
Meeting the objective of a risk-sensitive capital requirement for operational risk depends on the banks effectiveness in measuring that particular risk accurately. Consequently, banks must meet a number of both qualitative and quantitative supervisory standards.
The supervisory standards are intended to result in a process that has integrity. Therefore, the objective is to achieve a reasonable estimate of the level of operational risk exposure. These standards are minimum standards, and national supervisors may have additional requirements. Qualitative Standards Quantitative Standards
A. Qualitative Standards: General
SLIDE 22
If you are involved in assessing a bank's AMA, you must ensure that a number of general standards are met. There are three minimum qualifying general standards: The board of directors and senior management are actively involved in the supervision of the operational risk management framework. The bank has an operational risk management framework that is conceptually sound
11

and is implemented with integrity. The bank has sufficient resources involved in the use of the approach in major business lines as well as in the control and audit areas. In addition, a bank's AMA is subject to a period of initial monitoring by its supervisor before it can be used for regulatory purposes.
What happens if a bank that is approved to use the AMA no longer meets the minimum criteria for AMA? If a supervisor determines that a bank using an AMA no longer meets the AMA qualifying criteria, the bank may be required to revert to a simpler approach for some or all of its operations. If this occurs, the bank cannot use an AMA until such time as it has remedied the situation. In addition, the bank must meet the conditions specified by the supervisor before returning to a more advanced approach. After a bank has been approved for an AMA, it cannot revert to a simpler approach on its own accord.
Qualitative Criteria In addition to the three general standards, there are a number of applicable qualitative criteria a bank must meet before it can use an AMA for operational risk capital. Independence The bank must have an independent operational risk management function that is responsible for the design and implementation of the banks operational risk management framework. For example, a dedicated group, separate from the day-to-day operations, should develop and oversee the framework. Integration With Other Risk Management Processes The banks internal operational risk measurement system (ORMS) must be closely integrated with the day-to-day risk management processes of the bank. An ORMS should identify, assess, monitor and control operational risk as part of the banks overall risk management processes. Internal Reporting Comprehensive Internal Reporting of Operational Risk Exposures and Loss: There must be regular reporting of operational risk exposures and loss experience to business and management, senior management and the board of
SLIDE 22
12

directors Compliance/Non-Compliance Processes The bank must have a process in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operational risk management system. The process must also include policies for the treatment of non-compliance issues. Internal/External Audit Reviews Internal/External Auditors must perform regular reviews of the operational risk management processes and measurement systems. This review must include both the activities of the business units and of the independent operationa rosk management function Validation The banks external auditors or supervisors must be able to verify that the bank validates its internal operational risk management system appropriately. The external auditors or supervisors should also have ready access to system information to ensure that they can understand it. This means that data flows and processes associated with the risk measurement system must be transparent and accessible.
Which of the following are among the qualitative requirements for an AMA bank? An independent risk management function dedicated to operational risk only
SLIDE 24
Integration of the bank's ORMS into day-to-day management Reporting to senior management and the board of directors Documented policies, controls and procedures An annual audit by the external auditors of the banks ORMS Validation of the bank's ORMS by the bank's internal or external auditors A compliance function to ensure that the ORMS is consistent with policies and procedures
B. Quantitative Standards
AMA quantitative standards are the minimum parameters, procedures and systems banks are expected to use to determine credible and consistent estimates of the capital required in respect of operational
SLIDE 25
13

risk. Soundness Basel II seeks to ensure that banks' systems for assessing required capital are prudent and sensible and that they yield credible results.
Basel II does not specify the approach or distributional assumptions used to generate the AMA operational risk measure for regulatory capital purposes. This is in recognition of ongoing developments in operational risk measurement. Basel II provides a considerable amount of flexibility for banks to develop their operational risk measure. However, a bank must be able to demonstrate that its approach captures infrequent, but severe, loss events. In calculating its operational risk exposure, an AMA bank is expected to estimate the aggregate operational risk loss that it faces over a 1-year period at a 99.9 percentile confidence level. In other words, over a 1-year period, in only one of every one thousand cases would the loss experienced by the bank exceed the estimate. This level of soundness is comparable to the standard applicable under the internal ratings-based (IRB) approach for credit risk.
There are number of applicable quantitative criteria a banks AMA must comply with before it can be used for regulatory capital purposes. Consistency with Basel II Conditions An internal ORMS must be consistent with the Basel II definition of operational risk and the identified los event types. Expected/Unexpected Losses The banks AMA capital requirement for operational risk is the sum of expected losses (EL) and unexpected losses (UL); unless the bank can demonstrate to you that it can reasonably estimate EL for operational risk. In other words, a bank needs to demonstrate to you that it can reasonably estimate EL for operational risk and that it has in fact accounted for such EL in an acceptable way. A Granular Risk Measurement System A banks risk measurement system must be sufficiently granular. In other words, it must be detailed enough to capture the major drivers of operational risk that can affect the estimates of Infrequent, but sever, losses (tall events in loss distribution) Correlations Measures for different operational risk estimates must be added for the purpose of calculating the regulatory minimum capital requirement. However,
SLIDE 26
14

internally determined correlations in operational risks losses across individual operational risk estimates may be used. Key Features of an ORMS An ORMS must have certain key features including: a. relevant internal data b. relevant external data c. scenario analysis d. factors reflecting the business environment and internal control systems Weighting Based on Banks Profile a bank needs to have a credible, transparent, welldocumented and verifiable approach for weighting these fundamental elements in its overall ORMS
True or False? Banks should strive to establish their estimates for operational risk with the same degree of rigor as is done for market risk. Banks should strive to establish their estimates for operational risk with a comparable degree of rigor as is done for credit risk. Banks should strive to establish their estimates for operational risk with a higher degree of rigor than is done for credit risk.
SLIDE 27
SLIDE
To sum up
28
Basel II prescribes a set of qualitative and quantitative standards for an AMA, which provide superiors with some assurance that all AMA banks are subject to similar expectations despite the flexibility banks are allowed in the design of an AMA
The qualitative standards require The independence of the risk management function the integration of operational risk management with the management of other risks comprehensive internal reporting of exposures and losses Regular reviews of compliance with internal policies and procedures
15

the availability of the necessary information to support reviews by external auditors and or supervisors
The qualitative standards address: The minimumm acceptable soundness standard definitional consistency with Basel II the treament of expected versus unexpected losses granularity of the risk measurement system the recognition of correlation the requirement to consider and appropriately weight internal data, external data, scenarios, and busines environment and internal factors
SLIDE
II. Key Features of an ORMS

By the end of this topic, you will be able to describe the essential features of a credible operational risk management system (ORMS)
29
In particular, you will learn about internal loss data external data scenario analysis business environment and internal control factors
Key Features of an ORMS
SLIDE 30
A. Internal Loss Data

A bank's own operational risk losses, experienced in past years, form the cornerstone of its ORMS. Such internal loss data is one of the required elements in an AMA.
16

Tracking internal loss event data is essential to the development and functionality of a reliable ORMS. Internal loss data is crucial for relating a bank's risk estimates to its actual loss experience.
Internally generated operational risk measures used for regulatory capital purposes must be based on a minimum five-year observation period of internal loss data. This applies whether the internal loss data is used directly to build the loss measure or to validate it. When the bank first moves to an AMA, three years of historical data is acceptable.
The Eight Business Lines Defined by Basel II Basel II has defined eight business lines into which banks using an AMA must be able to categorize their own activities. These business lines are: corporate finance trading and sales retail banking commercial banking payment and settlement agency services asset management retail brokerage
< I N S E T >
B. Collecting Internal Loss Data There are eight requirements that an internal loss data collection process must meet. 1. A bank must be able to map its historical internal loss data into the business lines and the loss event types defined by Basel II. It must also be able to provide the results of this mapping to its supervisor. Nevertheless, the bank has discretion as to the extent its ORMS parallels those business lines and loss event types 2. The criteria for allocating losses to the specified business lines and loss event types must be objective and documented. 3. Specific criteria must be developed for assigning loss data for losses arising from an event in a centralized function (for example, an information technology department) or an activity that spans more than one business line. 4. Internal loss data must be comprehensive. In other words, all material activities and
17

exposures from all appropriate sub-systems and geographic locations must be captured.
What is meant when we say that internal loss data must be comprehensive?
Comprehensiveness of internal data Any excluded activities or exposures, both individually and in combination, should not have a material impact on the overall risk estimates. A bank must have an appropriate minimum gross loss threshold for internal loss data collection. The Basel Committee uses EUR 10,000 as an example.
The threshold for recording losses can vary by business line. It also varies from bank to bank. It is the responsibility of the bank to justify the basis for excluding data and the appropriateness of the thresholds. One method that supervisors can use to assess a bank's thresholds for excluding loss data is to compare them with those of its peers.
5. The amount of detail on loss events should increase as the size of the losses increases. Information collected should include the date of the event, the amount of recovery and description of the cause of the loss. 6. All material operational risk losses consistent with the definition of operational risk, including those related to credit risk, must be collected. Material operational riskrelated credit risk losses that historically were recorded as credit risk losses should continue to be recorded as credit losses for calculating the Pillar 1 capital requirement for credit risk, but will not be subject to the operational risk capital charge to avoid double counting. For example, a loss resulting from a bank's inability to liquidate collateral in the event of a borrower's default may be recorded as a credit loss even though poor collateral management practices may be the cause of the loss. 7. Operational risk losses that are related to market risk are subject to the operational risk capital charge. 8. Data must be accessible to supervisors and provided to them upon request.
SLIDE 32
18
Why are operational risk losses that are related to market risk subject to the operational risk capital charge?
Operational failures that result in market risk losses should be treated as operational risk losses and subjected to the operational risk capital charge. This is because market risk methodologies are calibrated from price movements, not actual losses. Excluding such operational risk losses from the calculation of the operational risk capital requirement may lead to under-capitalization.
There have been several high profile situations where large market risk related operational risk losses have been incurred, primarily as a result of a breakdown of internal controls. Included in this group are: Barings Bank collapsed in 1995 as a result of the actions of a rogue trader. Allied Irish Bank and National Australia Bank incurred large losses, in unrelated incidents that came to light in 2002 and 2004, respectively, because of unauthorized currency trading. Fraudulent trades by a single trader resulted in pre-tax losses of more than 4.9 billion in 2008 for Socit Gnrale.
C. Internal Loss Data Collection Process Identify the requirements for an AMA-approved banks internal loss data collection process. Internal loss data must be comprehensive and must be mapped into the loss eventtypes specified by Basel II. Individual operational risk losses exceeding EUR 10,000 must be captured by the ORMS. The criteria for allocating losses into business lines and loss event types must be objective and documented. Specific criteria must be developed for consistently categorizing loss information that spans more than one business line or that originates in a centralized function. A clear process must be developed for identifying and including credit risk-related
SLIDE 33
19

losses in the Pillar 1 calculation of operational risk capital requirement. A clear process must be developed for excluding operational risk losses arising from trading activities.
III. External Data
SLIDE 34
A bank's operational risk measurement system must use relevant external data. This is extremely important when there is reason to believe that the bank is exposed to infrequent, yet potentially severe, losses. External data can be: public data data collated from individual publicly reported loss events pooled industry data data assembled in a structured fashion by a group of banks
If a bank's internal loss history is not extensive enough to provide a reasonable basis for estimating major unexpected losses, it should turn to external data to complement its own internal data.
20

SLIDE A. Comprehensive Data External data should be comprehensive enough to enable a bank to assess its relevance for its own operational risk. External data should include: actual loss amounts information on the scale of business operations where the event occurred information on the causes and circumstances of the loss events 35
B. Process for Using Data A bank must have a systematic process for determining the situations in which external data is used. A bank also needs to develop a methodology to incorporate the data into its own processes, such as adjusting for scale or improving scenario analysis. The conditions and practices for the use of external data must be regularly reviewed, documented, and subject to periodic independent reviews.
SLIDE
C. Scenario Analysis and AMA

Another element of the AMA framework is scenario analysis. Scenario analysis is the systematic process of obtaining expert opinions from business managers and risk management experts in order to evaluate banks' exposure to high-severity events. These opinions are used to assess the likelihood and impact of severe but plausible operational loss events.
36
The results of the scenario analysis process need to be incorporated in a bank's AMA. For instance, scenario analysis results could be expressed as parameters of an assumed statistical loss distribution. Scenario analysis also should be used to assess the impact of deviations from the correlation assumptions that are embedded in the bank's operational risk measurement system. In particular, they should be used to evaluate potential losses resulting from multiple simultaneous operational risk loss events.
Scenario analysis may use a combination of internal and external data (for example, where an institution looks to industry experience) to generate plausible loss scenarios.
21

SLIDE
1. When to Use Scenario Analysis
37
Scenario analysis should be an integral part of a bank's ORMS. The scenario analysis should be more elaborate where internal and external data do not generate a sufficient assessment of the institutions operational risk profile.
For example, some individual banks may have only encountered a few, if any, internal occurrences of certain types of loss events. In addition, the banks may not have much experience of certain types of loss events that affect the banking sector in a particular jurisdiction.
Examples of low frequency events that can potentially result in high severity losses can include: unusual client lawsuits acts of terrorism natural disasters
The qualitative and subjective nature of a scenario analysis approach means that the assessments need to be validated over time against actual losses. This is particularly true for cases where the underlying data used is sparse.
SLIDE 38
IV. Business Environment and Internal Control Factors
Internal and external data provide an important historical picture of a bank's operational risk profile.
22

However, that profile can change over time as a result of: internal factors (such as expansion into new business activities or new regions or withdrawal from other areas) changes in internal controls changes in the business climate in the different countries where a bank has significant operations Therefore, it is important that a bank supplement its internal and external data by taking into account the fact that this historical profile can change as the business environment and its own internal controls change.
A bank's group-wide risk assessment methodology must capture the key business environment and internal control factors. An AMA bank must use these factors in its risk measurement framework.
What are the advantages of incorporating key business environment and internal control factors into a bank's risk assessment methodology?
By incorporating these factors into its methodology, a banks risk assessment will: be more forward-looking reflect more accurately the quality of the banks control and operating environments help align capital assessments with risk management objectives be able to recognize both improvements and deterioration in operational risk profiles more quickly
A. Criteria for Business Environment and Internal Control Factors

To qualify for regulatory capital purposes, the use of key business environment and internal control factors in a bank's risk measurement framework must meet the following standards: Each factor must be a meaningful driver of risk this is based on the experience and expert judgment of the affected business areas. The business line managers and specialists in the bank who are most attuned to the business conducted can best assess the potential risks facing that particular business.
SLIDE 39
23

The sensitivity of a bank's risk estimates to changes in the factors and the relative weighting of the various factors need to be well reasoned. For example, improvements in risk controls have to be assessed in light of potential increases in risk due to greater complexity of activities or increased business volume. The framework and each instance of its application, including the supporting rationale for any adjustments to empirical estimates, must be documented and subject to independent review within the bank and by supervisors. The process and its outcomes need to be validated through comparisons made over time to actual internal loss experience, relevant external data, and appropriate adjustments made.
True or False? In a bank whose primary activity is retail banking, improvements in internal controls in the trading function's back office would significantly improve the bank's overall operational risk profile. A banks ORMS must involve its senior management level strategists because the banks future plans and direction in terms of expansion or withdrawal from particular business lines can materially influence its operational risk profile. External loss data supplements banks internal data and is an important contributor to scenario analysis. Scenario analysis can be used to test and validate correlation assumptions in a banks ORMS.
SLIDE 40
To Sum up There are four essential elements in an effective operational risk management system: internal loss data that has been collected over a minimum five-year observation period and can be mapped to the business lines and event types that are defined in Basel II external data that is related to the bank (and scaled, as necessary) whether the data is collated from public reports or from a data pool created by a group of banks scenario analysis to assess the likelihood and impact of severe but plausible operational loss events, which can be particularly useful for banks that have little internal experience with certain types of loss
SLIDE 41
24

business environment and internal control factors, which provide useful insight into changes in a banks operational risk profile
V. RANGE OF AMAs As a result of the flexibility that Basel II allows banks in the design of an AMA, there is considerable variability in the AMAs that are in use. By the end of this topic, however, you will be able to categorize AMAs based on their key characteristics In particular, you will look at the
Loss Distribution Approach (LDA) Scenario-based Approach (SBA) Risk Drivers and Controls Approach (RDCA)
42
VI. CATEGORIES OF AMAs

Because the management of operational risk is a relatively new discipline in the field of risk management, Basel II intentionally provides banks with a significant degree of flexibility in the design of an AMA. Not surprisingly, then, the range of AMAs that has emerged is quite broad. It is nonetheless possible to identify a few broad categories into which many of the AMAs currently in use can be grouped. This categorization is based on which of the four required elements (that is, internal data, external data, scenario analysis, and business environment and internal control factors) drives the capital calculation. Regardless of which category may be most relevant, however, every AMA must still use all four elements. Many AMAs might therefore be more accurately seen as 'hybrids' of two or more of the broad categories described below. Loss Distribution Approach (LDA)
43
25

Scenario-based Approach (SBA) Risk Drivers and Controls Approach (RDCA) SLIDE 44 The principal building block of an LDA is its reliance on a banks own loss data. This loss data is the most objective risk indicator available and reflects the unique risk profile of each bank.
A. Loss Distribution Approach (LDA)
However, in most instances, internal data is insufficient and must be supplemented by external loss data. Loss data is also a historical measure that may not be reflective of the banks current exposure to operational risk.
Example of an LDA Process There are a number of steps involved in an LDA process: Step 1: Building a loss event database. This is the database of internal operational risk loss events organized in categories of losses and business activities that share similar risk profiles.
SLIDE 45
Step 2: Modeling loss frequency distributions. Statistical techniques are used to estimate the likelihood of loss events.
26
Step 3: Modeling loss severity frequency distributions. Different techniques can be used to estimate the range of probable loss amounts for each loss type and business line. Techniques such as extreme value theory can be used. The resulting distributions have different shapes that are then combined in he next step to create the actual loss distribution itself.
Step 4: Combining the different loss frequency and loss severity distributions, using Monte Carlo simulations or other statistical techniques to form a total loss distribution for each loss type/business activity combination, for a given time horizon.
Step 5: Fitting the distribution of observed total loss points to a curve reflecting the underlying pattern of total loss occurrences. This curve would be established from a standard statistical distribution type.
27
LDA and Capital Required

The loss distribution generated in the LDA represents the range of possible operational losses associated with that particular loss event-type and business line for a predetermined period of time. The distribution can then be used to determine the level of capital required at the desired percentile.
SLIDE 46
Under Basel II, the 1-year time horizon and the 99.9 percentile level applicable to credit risk, under an internal ratings-based approach, also applies to operational risk. 47
Example of a Scenario-based Approach (SBA) The SBA involves the development of a representative set of scenarios that take into account all relevant risk factors. The SBA shares common elements with other approaches. For example, the development of a statistical model founded on frequency and severity distributions.
There are a number of steps involved in an SBA process: Step 1: Generating scenarios. Risk factors reflecting the operational risk profile of the bank are identified and categorized into scenario classes. The scenario classes can then be applied to the different business lines that can be impacted by that particular risk factor.
Step 2: Assessing the generated scenarios. This is based on various criteria, which includes historical loss data, key risk indicators, insurance cover, the quality of relevant risk factors, and the control environment.
28

This type of assessment: results in frequency and severity estimates is set out in a range
Step 3: Validation of estimates. This process verifies the reasonableness of the data resulting from the scenario assessment in the context of the groups operational risk profile. The techniques used can involve internal audit assessments, comparisons of losses against experts expectations and reviews by risk managers.
Step 4: Development of a statistical model based on frequency and severity distributions. Methods used include Monte Carlo simulation.
Step 5: Derivation of the capital requirement from the overall loss distributions. This is based on the chosen time horizon and confidence intervals.
29
Risk Drivers and Controls Approach (RDCA)

The RDCA, or Scorecard Approach, has at its core an assessment of specific operational risk drivers and controls.
SLIDE 48
The RDCA assesses the: level of exposure to specified drivers of risk for each business unit of a bank scope and quality of a bank's internal control environment, key operational processes and risk mitigants The RDCA links these assessments to the allocation of operational risk capital across a bank's business units. Because the strength of an RDCA is not in the initial calculation of required operational risk capital but in the way it can be used to allocate capital based on the relative level of risk and quality of controls, supervisors are unlikely to come across it in its 'purest' form. Rather, the main elements of an RDCA are most often incorporated in some sort of hybrid approach that relies extensively on internal loss data or scenario analysis.
SLIDE
Example of an RDCA Process

There are a number of steps involved in an RDCA process. In addition, the RDCA incorporates other approaches as essential elements of the assessment.
49
Step 1: Making an initial determination of the operational risk capital requirement based on a number of techniques.
30
Step 2: Using a questionnaire consisting of weighted, risk biased questions to assess, the principal drivers and controls of operational risk, across the range of operational risk categories for the bank.
Step 3: Allocating the initial risk capital requirement for each of the various risk categories, such as internal fraud. This allocation also takes into account: internal and external data for operational risk qualitative information from the questionnaire
Step 4: Distributing the allocated capital for each risk category to each business unit. The distribution is based on the risk profile and scaling determined by the RDCA questionnaire.
AMA Range of Practice

In July 2009, the Basel Committee published the paper Observed range of practice in key elements of Advanced Measurement Approaches (AMA). The paper describes specific practices that supervisors have observed in AMA banks in three areas: internal governance, data and modelling. The principal purpose of the paper is to catalogue the key challenges and corresponding practices in these areas and provide a means of framing the discussion of what constitutes an acceptable practice but without passing judgment on practices reflected in the paper. The practices were observed across a broad crosssection of banks whose AMAs might be categorized as an LDA, an SBA or some sort of hybrid that reflects the key characteristics of these approaches, as well as the RDCA.
SLIDE 50
Advanced Measurement Approaches

True or False?
Slide 51
The AMAs developed for determining the operational risk capital requirement need to be approved by bank supervisors. Slide 52
The LDA relies on scenario analyses only to validate the operational risk estimate.
The SBA requires a less rigorous quantitative basis than the other types of AMA.
31

The Scorecard Approach combines various techniques and approaches in an assessment of capital requirements for various business lines.
To Sum up Despite the considerable variability in operational risk measurement approaches across AMA banks, most AMAs can be broadly categorized into one of three types of AMA based on which of the four required elements (internal data, external data, scenarios, and business environment and internal control factors) drives the capital calculation. A Loss Distribution Approach (LDA) relies heavily on a banks own internal loss data. A Scenariobased approach (SBA), on the other hand, makes extensive use of scenarios. A Risk Drivers and Controls Approach (RDCA) assesses the level of exposure of each business line to specified risk drivers and the quality of internal controls, then links these assessments to the allocation of operational risk capital across a banks business units.
SLIDE
Risk Mitigation
An AMA bank is allowed to recognize the riskmitigating impact of insurance in measuring operational risk for regulatory minimum capital requirements. Under Basel II, the recognition of insurance mitigation is limited to 20% of the total operational risk capital charge calculated under the AMA.
54
Basel II sets out a number of requirements that must be complied with in order for insurance to be recognized as a qualifying operational risk mitigant. These requirements are primarily intended to ensure that a bank will have its claims for losses on insured events paid. SLIDE 55
32

Requirements for Recognition of Insurance
There are eight requirements that a bank must comply with in order for insurance to be recognized as a qualifying operational risk mitigant. Requirements : 1. 2. The insurance provider must have a minimum claims paying ability rating of A (or equivalent). The insurance policy must have an initial term of at least one year. For policies with a residual term of less than one year, the bank must make appropriatehaircuts that reflect the declining residual term of the policy. Policies with a residual term of 90 days or less are subject to a 100% haircut. 3. 4. The insurance policy must have a minimum notice period for cancellation of 90 days. The insurance policy must not have exclusions or limitations that are triggered by supervisory actions or, in the case of a failed bank, that preclude the bank, receiver or liquidator from recovering for damages suffered or expenses incurred by the bank. The policy may have exclusions or limitations for damages that occur after the initiation of receivership or liquidation proceedings in respect of the bank. Additionally, the exclusion of coverage for any fine, penalty, or punitive damages resulting from supervisory actions is considered an acceptable feature of the insurance policy. The existence of these exclusion clauses does not invalidate the insurance coverage. SLIDE 56 5. The bank's risk mitigation calculations must reflect the extent to which insurance provides protection. The calculations must reflect and be consistent with the likelihood and impact of loss used in the bank's overall determination of its operational risk capital.
The insurance must be provided by a third party entity. However, insurance cover obtained from subsidiaries and affiliates can be recognized provided the exposure is laid off, for example through re-insurance, to an independent third party entity that meets the eligibility criteria. 7. The framework for recognizing insurance must be well reasoned and documented.
8. The bank must disclose a description of its use of insurance for the purpose of mitigating operational risk.
33
Do You Know? Mitigants for Operational Risk The Basel Committee signaled its intention to have an ongoing dialogue with the banking industry with respect to the use of mitigants for operational risk. Depending on those discussions and developments, the Basel Committee may consider modifying the criteria and the limits for the recognition of operational risk mitigants.
IN SHORT
Bank Requirements
The eight requirements that a bank must comply with in order for insurance to be recognized as a qualifying operational risk mitigant are: 1. minimum insurer rating of A 2. term > 1 year or a haircut 3. minimum notification for cancellation 4. conditions respecting exclusions/limitations 5. recognition commensurate with risk mitigation 6. independence of insurance provider 7. soundness of mitigation recognition 8. disclosure of insurance mitigation
Insurance as a Risk Mitigant

SLIDE Identify the insurance coverage that can be recognized as an operational risk mitigant under Basel II. 57
34
1.
Insurance provided by a subsidiary of the banking group and retained by that subsidiary
2.
An insurance policy that has an initial term of five years and has a one-month cancellation provision
3.
The insurance coverage mitigating operational risk, as well as the terms of that coverage, is kept entirely confidential between the contracting parties
4.
The insurance policy is provided by a AA-rated insurance company and is for a term of three years
To sum up Subject to the approval of it supervisor, an AMA bank is allowed to recognize the risk mitigating impact of insurance and calculating its operational risk capital requirements under Basel II. The benefit is limited to 20% of the total operational capital charge. An insurance policy is eligible for this treatment only if it meets prescribed conditions, which are intended to ensure that a banks claims under the policy will be paid. The conditions include:
SLIDE 58
The insurer must have a minimum claims paying ability of A The policy must have an initial term of at least one year an a minimum notice period of cancellation of 90 days The insurance must be provided by a third party
SLIDE AMA Implementation and Transitional Issues 59
Once you have completed this topic, you will be able to outline some of the key considerations in the implementation of an AMA, especially in relation to banks that operate across national borders. In particular, you will learn about
35

1. allocating group-wide AMA capital to subsidiaries and the circumstances under which allocation is permitted 2. cross-border implementation and the hybrid approach for AMA banks 3. the conditions under which diversification benefits can be recognixed in an AMA 4. the transitional arrangements from moving from Basel I to Basel II with an AMA
SLIDE
I. AMA Implementation and Transitional Issues

A. AMA and Capital Allocation
60
So far, you have learned about the group-wide operational risk capital requirement for a banking group that implements an AMA. But what are the expectations in terms of the standalone operational risk capital Identify the insurance coverage that can be recognized as an operational risk mitigant under Basel II.
Insurance provided by a subsidiary of the banking group and retained by that subsidiary
An insurance policy that has an initial term of five years and has a one-month cancellation provision
The insurance coverage mitigating operational risk, as well as the terms of that coverage, is kept entirely confidential between the contracting parties
The insurance policy is provided by a AA-rated insurance company and is for a term of three years
The requirements of banking subsidiaries of such groups, particularly where those subsidiaries are located in different jurisdictions than the group parent? Should those subsidiaries be required to implement an AMA and comply with all relevant qualifying criteria for purposes of reporting to the relevant host supervisor? Implementing an AMA at the level of a foreign banking subsidiary could be costly in relation to the
36

potential benefits, particularly where the subsidiary is small. On the other hand, when Basel II was being developed the banking industry expressed concern that the alternative that is, requiring all foreign subsidiaries to implement either the BIA or SA for host supervisory purposes would result in more required capital, in aggregate, when each of the subsidiaries' individual requirements were added up than the total capital that would be required under the group-wide AMA (at least in part because of the potential for AMA banks to recognize diversification benefits). For this reason, Basel II provides that a subsidiary of a bank that has adopted the AMA may be permitted to use an allocation mechanism for the purpose of determining its standalone operational risk capital requirements
***allocation mechanism
An allocation mechanism is a technique for notionally allocating a portion of the group-wide operational risk capital requirement to a subsidiary within the banking group.
Allocation Mechanism Guidelines
SLIDE 61
The opportunity for a subsidiary of an AMA bank to use an allocation mechanism is subject to the approval of the subsidiary's host supervisor and the support of the bank's home supervisor. For an allocation mechanism to be approved, a bank must demonstrate to the relevant supervisors that the mechanism and the resulting amount of capital are appropriate and that the amount can be supported empirically.
37
The allocation mechanism is only available to banking subsidiaries that are: deemed to be not significant relative to the overall banking group or to the jurisdiction in which it operates subject to the application of Basel II requirements on a standalone basis Where a banking subsidiary of an AMA bank is deemed to be significant, the subsidiary cannot use an allocation mechanism to determine its standalone operational risk capital requirement. If it wishes to implement an AMA and is able to meet the qualifying criteria, the subsidiary would have to calculate its AMA capital requirements on a standalone basis. Otherwise, a significant subsidiary would have the option of using the BIA or SA, provided this option is agreeable to the host supervisor.
***host supervisor A host supervisor is the supervisory agency responsible for the oversight of banking subsidiaries within a banking group headed by a top bank or bank holding company that is subject to the jurisdiction of another supervisor (the home supervisor).
***home supervisor The home supervisor is the supervisory agency responsible for the oversight, on a consolidated basis, of the top bank or bank holding company of a banking group.
'Significant' Banking Subsidiaries
The Basel Committee has not defined what constitutes a 'significant' banking subsidiary, leaving this determination to national supervisors. It was expected that the decision regarding the significance of a particular subsidiary would be arrived at in discussions between the relevant home and host supervisors, and that the number of subsidiaries deemed significant would be relatively low for individual banking groups.
At the same time, however, the Committee recognized that a subsidiary that is
38

insignificant relative to the overall banking group could be significant to the economy of the host jurisdiction in which it operates. This could mean that host supervisors would be less willing to allow such subsidiaries to use an allocation mechanism.
Allocation Mechanisms Principles
In November 2007, the Basel Committee published a paper entitled Principles for home-host supervisory cooperation and allocation mechanisms in the context of Advanced Measurement Approaches (AMA). In order to facilitate the implementation of the hybrid AMA, the paper provides guidance regarding supervisors' expectations about what might constitute an acceptable allocation mechanism.
Cross-border Implementation Principles
SLIDE 62
In an effort to balance the banking industry's concerns with supervisors' expectations that banks be adequately capitalized at all levels within a banking group, the Basel Committee introduced what is described as a 'hybrid' approach for AMA banks. Under this hybrid approach, a banking group is permitted subject to supervisory approval to use a combination of standalone AMA calculations for significant internationally active banking subsidiaries and an allocated portion of the group-wide AMA capital requirement for its other internationally active banking subsidiaries.
Recognizing the challenges inherent in this hybrid approach, the Basel Committee agreed on certain principles to guide home and host supervisors in the cross-border implementation of a group-wide AMA for operational risk.
Principle 1: You must ensure that the calculation of AMA capital requirements is consistent with Basel. Its scope of application, and the Committees paper on high-level principles for the cross-border implementation of the New Accord
39
Principle 2: You need to ensure that the board of directors and senior management at each level of a banking organization are aware that they have an obligation to understand the operation risk profile at the level of the organization.
The board of directors and senior management must also ensure that risks are managed appropriately, and that adequate capital is held at each level in respect of those risks.
Principle 3: In general, capital is not freely transferable within a banking group. This is especially true during timesof stress. Therefore, you should ensure that each banking subsidiary within the group is adequately capitalized on a standalone basis.
Principle 4: Where possible, you should balance the above principles with the goal of minimizing the burden and cost for both banking organizations and supervisors of implementing the AMA on a cross-border basis.
AMA and Capital Allocation
SLIDE 63
True or False?
A bank using an AMA can use an allocation mechanism for a banking subsidiary, as long as the banking subsidiary is itself subject to Basel II in its own right. A significant subsidiary should have its own AMA reflecting its own circumstances. The host supervisor of a subsidiary of a foreign-based banking group can rely on the home supervisor's approval of a group-wide AMA and in turn permit its use, through an allocation mechanism, by the subsidiary.
Diversification Benefits
SLIDE 64
40

Diversification benefits arise when the impact of developments increasing risk in one area of operations, for example a particular business line, is mitigated because risk decreases in another area of the bank. An AMA may incorporate diversification benefits if: there is a clear and supported rationale for doing so supervisory approval has been obtained
Supervisory approval is subject to the criteria for recognizing correlations with which banks must comply. If a bank has been permitted partial use of an AMA, those activities that are excluded from the AMA calculation must not be factored into the AMA determination of group-wide diversification benefits.
Incorporating Diversification Benefits

Diversification benefits can be factored in at the group level or at the banking subsidiary level. When host supervisors determine that a bank subsidiary in a banking group must calculate standalone Basel II capital requirements (see the Scope of Application (Basel Capital Framework) tutorial), the bank subsidiary may incorporate the diversification benefits of its own operations. This is subject to supervisory approval. In other words, the subsidiary cannot incorporate the diversification benefits of the parent.
SLIDE 65
Why should a bank subsidiary not benefit from the diversification benefits that the banking group may realize as a group?
It is reasonable to assume that a banking group has the advantage of diversification benefits if there is a low probability that operational risk losses occur simultaneously across subsidiaries or business lines. In practice, banking subsidiaries within a banking group may not always be able to rely on assistance from other parts of the group. This is because capital, in most cases, is not freely transferable between separate legal entities and across national boundaries.
Experience shows that there are usually legal and other obstacles to the transfer of capital. This is most obvious during periods of stress, where one entity may be in a
41

surplus capital position while another may be capital deficient. As a result, banking group diversification benefits must be excluded from a significant banking subsidiary.
SLIDE 66 Implementation of the Basel II framework is subject to the application of a capital floor that is based on a comparison of capital requirements produced by Basel II and the 1988 Accord. The capital floor comes into play for banks using the IRB approaches for credit risk or an AMA for operational risk.
Transitional Arrangements
The capital floor is a transitional measure intended to ensure that the more risk sensitive approaches for determining capital requirements for credit and operational risk do not result in significant declines in the level of capital in individual banks.
***capital floor A capital floor is an amount below which the regulatory capital level of a bank cannot fall.
Capital Floor The capital floor is calculated by applying an adjustment factor to the following amount: 8% of the Risk-Weighted Assets + Tier 1 and Tier 2 Deductions Amount of General Provisions That may be Recognized in Tier 2
SLIDE 67
The adjustment factor for banks using one of the IRB approaches or an AMA is 80%.
The calculation of a floor means that banks need to continue calculating their capital requirements under the 1988 Accord during the transitional period. As part of the implementation of the Basel II framework, parallel calculations need to be performed banks must calculate capital requirements based on the 1988 Accord and must also calculate IRB and AMA capital requirements.
42
SLIDE
Calculation of Capital Floor for an AMA Bank The calculation of the capital floor is set out in the following example. The bank's regulatory capital is subject to an 80% floor, being USD 0.84 bn.
68
Calculation of Floor: Risk-weighted assets Bank capital Deduct: Investment in subsidiaries Add: General reserves Regulatory bank capital ($0.30 bn) $0.05 bn $10.00 bn $1.20 bn $0.90 bn $0.95 bn $0.95 bn
Capital ratio ($0.95 bn/$10 bn) Floor 8% of risk-weighted assets (8% X $10 bn)
9.50%
$0.80 bn
Add: Deduction for subsidiaries Deduct: General reserves Floor ($1.05 bn X 80%)
$0.30 bn ($0.05 bn)
$1.10 bn $1.05 bn $0.84 bn
To sum up Implementing an AMA at the level of a foreign banking subsidiary could be costly In relation to the potential benefits, particularly where the subsidiary is small. For this reason, Basel II provides that a subsidiary of a bank that has adopted an AMA may be permitted to use an
SLIDE 69
43

allocation mechanism for the purpose of determining its standalone operational risk capital requirements. Allocation mechanisms can only be used by subsidiaries that are not significant, and must be approved by the home supervisor.
The hybrid approach refers to the situation where a banking group implements a combination of standalone AMA calculations for significant internationally active subsidiaries and an allocation of group-wide AMA capital for its other internationally active subsidiaries. Four principles were developed by the Basel Committee to guide the use of the hybrid approach.
An AMA may incorporate diversification benefits if there is a clear supported rationale for doing so and supervisory approval has been obtained. Supervisory approval is subject to banks meeting prescribed criteria.
For a transitional period, the minimum regulatory capital requirement for an AMA bank is subject to a floor that uses Basel I as its base. The existence of a floor means that an AMA bank has to calculate its capital requirements twice once usin Basel I and another time using Basel II.
SUMMARY What is an Advanced Measurement Approach (AMA)? An Advanced Measurement Approach (AMA) is a bank-specific internal method under Basel II for identifying, assessing, and quantifying operational risk and calculating the related regulatory capital requirements. Banks that use an AMA are typically those with significant operational risk exposure. The use of an AMA by a bank is subject to supervisory approval.
SLIDE 70
When an AMA is generally a group-wide method that captures all material operational risk at all levels within a banking group. Basel II allows for partial use of the AMA on a transitional or permanent basis for banks that meet prescribed conditions. Are there any Because Basel II allows banks considerable flexinity in the design of
44

requirements that an AMA has to meet to be considered acceptable? an AMA, AMAs can look very different from bank to bank. Consequently, Basel II prescribes a set of qualitative and quantitative standards for an AMA, which provides supervisors with some assurance that all AMA banks are subject to similar expectations.
There are qualitative standards that address such issues as the independence of the risk management function, the integration of operational risk management with the management of other risks, and the need for comprehensive internal reporting of excuses and losses. There are also quantitative standards that define a minimum acceptable soundness standard, discuss the treatment of expected versus unexpected losses, and require the use of four specific elements, among other things. What are the four required elements of AMA? internal loss data that has been collected over a minimum five-year observation period external data that is relevant to the bank (and scaled as necessary) scenario analysis to assess the likelihood and impact of severe but plausible operational loss events business environment and internal control factors which provide useful insight into changes in a banks operational risk profile. How can AMAs be characterized? Most AMAs can be broadly categorized into one of the three types of AMA (or some hybrid of the three) based on which of the four required elements drives the capital calculation: A Loss Distribution Approach (LDA), which relies heavily on a banks own internal loss data A Scenario-based Approach (SBA), which makes extensive Every AMA must include the four essential elements of an effective operational risk measurement system (ORMS). There are:
45

use of s. scenarios. A Risk Drivers and Controls Approach(RDCA) which assesses the level of exposure of each business line to specified risk drivers and the quality of internal controls, then links these assessments to the allocation of operational risk capital across a banks business units Can an AMA bank reduce the operational risk capital requirements through some form of risk mitigation? Does a foreign subsidiary of an AMA bank also have to implement an AMA on a standalone basis? Subject to the approval of its supervisor, an AMA bank is allowed to recognize the risk mitigating impact of insurance in calculating its operational risk capital requirements under Basel II. The benefit is limited to 10% of the total operational capital charge. An insurance policy is eligible for this treatment only if it meets prescribed conditions. Implementing an AMA at the level of a foreign banking subsidiary could be costly in relation to the potential benefits, particularly where the subsidiary is small. For this reason, Basel II provides that a subsidiary of a bank that has adopted an AMA may be permitted to use an allocation mechanism for the purpose of determining its standalone operational risk capital requirements. Allocation mechanisms can only be used by subsidiaries that are not significant, and must be approved by the relevant host supervisor and supported by the home supervisor.
71
TAKE THE TEST Now try these questions on Basel II Operational Risk AMA to evaluate how well you have mastered the objectives of this tutorial.
SLIDE 72
There are 8 questions in this test. Some of them may contain more than 1 input. You will be scored on the basis of 1 point per input.
Avoid using the Back button on your browser, as this will interrupt the test and bring you back
46

to this page.
Question 1 of 8 True or False? Historical internal data on operational losses need to be adjusted in the event of significant improvements in a banking group's internal control environment. External data should be used in an AMA to supplement a group's internal data but it must be adjusted to align it with the operations and risk profile of the bank.
SLIDE 73
Scenario analysis can be used as a means of incorporating the impact of infrequent but high severity events in an AMA.
Question 2 of 8
SLIDE 74
Identify the key features that are required in an AMA banks ORMS. Internal loss data representing at least seven years of operational risk losses. External loss data to supplement internal loss data. A means of taking into account the strengths and weaknesses of the internal control environment. Scenario analysis to assess the bank's exposure to high severity events
A process for reflecting, in the operational risk measure, the impact of the business environment.
Question 3 of 8
Under which of the following circumstances would partial use of an AMA be permissible?
A bank that has received approval for partial use of its AMA must meet all pre-conditions for an AMA. This extends to those operations that are assessed by a simpler method, such as the BIA or SA.
A banks AMA must capture all operational risks for only its significant
47

international operations.
A home supervisor may allow a parent bank that is using the BIA or SA to include in its consolidated capital calculation a foreign subsidiary's AMA operational risk capital charge, provided the AMA has been approved by the host supervisor.
A host supervisor cannot approve an AMA used by a subsidiary of a foreign-based bank if the home supervisor does not permit the use of an AMA at the group level..
Question 4 of 8
Which of the following statements relative to diversification benefits is accurate from a supervisory perspective?
Significant banking subsidiary in a well diversified AMA-approved banking group can recognize in its standalone AMA calculation any diversification benefits derived from other parts of the banking group.
An AMA bank's capital requirements for operational risk can only flect diversification benefits in its AMA if they are based on correlation estimates provided by the bank's supervisor. An AMA-approved banking group can incorporate a well-reasoned internal estimate of groupwide diversification benefits in its AMA.
76 77
Question 5 of 8 Complete the following sentences.
A bank can offset up to _____ % of its operational risk capital requirement with insurance coverage. The insurance company providing the coverage must have a claims ratio of paying ability rating of at least _____ , or equivalent, from a recognized rating agency. If the insurance policy is less than ________ days from its expiry date, no risk mitigating benefit is available. The initial term of the policy cannot be less than ______year(s). The risk mitigating benefits of insurance provided by a subsidiary or an affiliate of the bank can be recognized provided
48

______ of the risk is reinsured with another insurance company that itself meets the criteria for eligibility.
SLIDE
Question 6 of 8 True or False? A banking group adopting an AMA can benefit from an unrestricted reduction in its capital requirement for operational risk. The application of the capital floor for banks using an advanced IRB approach and an AMA means that they will also need to calculate capital requirements using the Standardized Approach for credit risk and the Standardized Approach for operational risk. Banks using an advanced IRB approach or an AMA will need to calculate capital requirements using Basel I requirements for as long as the capital floor is in effect.
78
Question 7 of 8
SLIDE 79
Under which of the following circumstances would an allocation mechanism for operational risk capital requirements be suitable? (Assume that in all cases the parent bank has been approved to use an AMA and the banking subsidiary is subject to Basel II requirements on a standalone basis.) large banking subsidiary with specialized operations that are not carried out in other parts of the banking group. relatively small banking subsidiary whose activities closely mirror those of the larger group. large, well-diversified banking subsidiary. banking subsidiary whose board of directors and senior management has not conducted their own assessment of the allocation mechanism.
SLIDE
Question 8 of 8
80
49

Which of the following statements relating to the qualitative standards for an AMA bank are correct?
The bank's ORMS must be well documented in terms of internal policies, controls and procedures and must include a process for dealing with instances of non-compliance
Internal auditors or the bank's external auditors must carry out semiannual reviews of the operational risk management processes and measurement systems
The output of the bank's ORMS must be an integral part of monitoring and controlling its operational risk profile.
Procedures must be in place for reporting operational risk exposures and losses to senior management and the board of directors and for taking action commensurate with those reports.
50

Basel II - Operational Risk - AMA

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Basel II - Operational Risk - AMA

Uploaded by

Copyright:

Available Formats

Basel II Operational Risk AMA