Assessing Stress Testing as a Practical Risk Management Tool_071911[1]

Center for Financial Services

Assessing stress testing as a practical risk management tool

Perspectives on financial reform Issue 1

1 Foreword 2 Assessing stress testing as a practical risk management tool 3 Infrastructure: The build out 5 Governance 7 Stressing for different risks 9 Reverse stress testing: Coming soon 10 Results: From testing to management 11 Conclusion 12 Contacts

Bankers and regulators worldwide have been increasingly focused on enhanced stress testing as a risk management tool to help gauge and reduce vulnerability to unexpected external shocks. The attention being paid by regulators to systemic risk has increased the focus on stress testing. As techniques are improved and banks become more familiar with the processes required, enhanced stress testing is emerging as a standard supervisory tool, putting a premium on understanding what it involves and how it can best be used.

The Deloitte Center for Financial Services commissioned this white paper as a contribution to the ongoing development of stress testing inside actual institutions. I would like to thank those individuals who gave their time and expertise to help develop the paper, as well as those who reviewed and commented on it in earlier draft form. The descriptions given by various banks of their approaches to stress testing are based on interviews conducted in April 2011. These were subsequently checked with and approved by the institutions concerned.

Sincerely,

Andrew FreemanExecutive Director,Deloitte Center for Financial Services,Deloitte LLP

Assessing stress testing as a practical risk management tool 1

Foreword

Banks have long “stressed” at least parts of their portfolios for the impact of changes in financial factors on key capital, liquidity and profitability measures. But until recently their main focus was often limited to certain financial risk types, such as market and credit risk, with perhaps less focus on operational and liquidity risks. The risks were often looked at individually instead of on an aggregated basis. Lines of business or market and credit risk units ran their own tests. Results weren’t always consolidated, tied to risk appetite, or used to manage the business or to help set capital levels. Stress scenarios were often based on relatively small moves in individual financial variables, such as interest rates or credit spreads. Meanwhile, larger stress scenarios were often considered to hold little credibility and hence were typically ignored. At the same time, what regulators wanted from stress testing wasn’t always clear to many institutions.

This is no longer the case. Global regulators have stepped up demands for an ever more consistent, aggressive and comprehensive approach to stress testing as part of the revised internal capital adequacy assessment process (ICAAP) stipulated by Basel II. An important element of the new stress-testing regime is the adoption of a more thorough, enterprise wide approach, with stress test scenarios defined by anticipated future economic conditions rather than simpler historic scenarios. These then help dictate the corresponding financial measures applied to all of the bank’s business. Top US banks have recently emerged from a second round of regulatory stress tests, with varying but generally positive results. At the time of this writing, EU banks are just starting a new stress testing series mandated by the European Banking Authority, and UK banks are poised to start a fresh cycle. A great debate revolves around whether the assumptions and scenarios of these various stress tests are too lenient. In China, bank regulators recently demanded the application of a stress scenario based on a dramatic plunge in real estate prices. The UK’s Financial Services Authority (FSA) has taken the lead in calling for tougher scenarios to be developed, in part through so-called reverse stress testing.

Typically, in the stress testing banks have performed, one or more predetermined scenarios are applied to single, multiple or enterprise-wide portfolios. A bank might run, say, three to five different scenarios specifying various percentage changes in a set of economic indicators such as real GDP, unemployment rates, housing prices and equity prices. Alternatively, scenarios might focus on changes in risk factors relevant to the organization. Scenarios can be imposed by regulators, derived from historic situations or created by an individual bank’s management. The objective is to see what happens to such crucial elements as liquidity, profitability, and capital so that, in theory, unacceptable outcomes can be avoided or be mitigated by a series of management actions that has been thought through and agreed upon in advance.

Under reverse stress testing a bank starts with an improbable but plausible outcome—Tier One capital falls to X, or the dividend must be cut or the bank fails. Then, risk, finance and business managers think through what circumstances could have led the bank to this outcome and imagine the risks that might have contributed. The goal is to provide a handle on what a bank might do to reduce the identified risks or to shore up its defenses.

This white paper aims to examine some of the challenges of making stress testing live up to expectations. To that end, the Deloitte Center for Financial Services has interviewed risk managers from leading banks operating around the world about their efforts to implement more comprehensive stress testing. Their most pressing concerns appear to revolve around:• Developingtherightinfrastructure• Refiningthegovernanceframework• Coveringthegamutofrisks–frommarketandcredittooperatingandliquidity• Employingreversestresstestingfruitfully• Linkingstresstestsresultstostrategicandcapitaldecisions

2

Assessing stress testing as a practical risk management tool

“Stress testing is especially important after long periods of benign economic and financial conditions, when fading memory of negative conditions can lead to complacency and the underpricing of risk. It is also a key risk management tool during periods of expansion, when innovation leads to new products that grow rapidly and for which limited or no loss data is available.” –Basel Committee, May 2009

Assessing stress testing as a practical risk management tool 3

Perhaps one of the biggest challenges is to construct an enterprise-wide stress testing and risk management infrastructure that can cope with the job of running multiple scenarios. The scenarios often depend upon vast quantities of differently sliced firmwide data run through multiple models to generate stress tests results. But how to make these useable when, in some cases, the outputs are daily results that can be communicated easily and clearly to management and then linked tightly to strategy, risk appetite and capital planning? The ensuing pressure on people and on data and IT systems has often been significant and the costs not inconsiderable. “It is a challenge, and it can be expensive,” says Darryll Hendricks, head of investment banking risk methodology at Swiss-based UBS (Mr. Hendricks is based in the bank’s New York offices).

PeopleAssembling a team with the right mix of quantitative, financial, IT and/or economic skills demanded by stress testing does not come cheaply. Indeed, cost tends to be more of a consideration than supply, Mr. Hendricks says, although he notes that typically it can take three to four months to find a replacement for a vital member of the stress-testing team. “I don’t think it’s impossible to find people in the market at the moment. The key is can we find the balance between the value we receive from adding more staff and the incremental costs to the firm,” he says.

Since the crisis, UBS says it has roughly doubled to between five and 10 the number of full-time-equivalent headcount doing stress testing in the investment bank alone. It has a few more people at the group level to monitor stress testing across all the business divisions and to focus on less standard risk categories such as business and operational risk.

For many banks, stress testing is just one component of other jobs. The Royal Bank of Canada (RBC) says it operates on a distributed model where stress testing capabilities are embedded in six different groups across group risk management and corporate treasury. These groups all have positions where stress testing is an explicit part of their mandate. In addition, the enterprise-wide stress testing program draws on resources and expertise across RBC. The economics department plays an active role in developing the macro-economic scenarios, the lines of business help define the assumptions and finance plays a significant role in the financial modeling of the scenarios. With the increased use of stress testing in both management and governance processes RBC notes that it plans to add to the number of people working on its stress testing teams.

In the near future, having dedicated staff is likely to become more common. A more consistent firmwide approach can provide management with a better foundation for capital decisions, says Sabeth Siddique, a director at Deloitte & Touche LLP, who leads Deloitte’s banking-related, credit-risk services within its governance, regulatory and risk strategies practice. Already Credit Suisse has gone this route, with a large dedicated stress testing team within its market-risk management group. Of the group, one-third of the team is focused on corporate-wide stress testing, with the rest working on investment banking market risk, the bank says.

Data and IT systems Collecting the appropriate data and having versatile systems in place to integrate massive volumes of information from disparate sources in an opportune and useful manner can be critical to the successful completion of regulatory and internal stress testing and capital planning exercises. The strains on data and IT systems can be significant.

Data: Getting the right data to calculate good loss estimates for different types of risks poses one set of problems, aggregating the information another. As with any aspect of regulatory oversight or risk management, careful analysis is crucial to ensure that the data make sense, are accurate, are not double counted, and perhaps most importantly, are easy to explain.

Data must be scrubbed, checked for quality and refreshed periodically, duplication eliminated and revisions made, so that the potential for misleading end results can be reduced. Banks, especially the large and complex ones, may need to consider whether they have captured all the relevant data and made the right assumptions. Data gaps remain an obstacle, particularly in areas where there may be insufficient historical information (such as operational risk) to support reliable predicted loss calculations.

Despite a shift towards automation, the quick assessment of new stress scenarios is often impeded by the need to input manually thousands of risk factor shocks corresponding to views about how each variable would respond to the new scenario. To address this, UBS says it has developed a modular tool that lets it modify and construct scenarios for market risk more quickly.

Perhaps the greatest hurdle is data aggregation. For example, for market risk this may require standardized valuations across businesses, geographies, products and risk types and across dissimilar, front-office collection systems. Legacy systems left from past investments and acquisitions can add further complications.

Infrastructure: The build out

1 Mr. McKenna left the bank shortly before publication of this paper.

4

Systems: The upshot for many banks may be an ongoing need for substantial investment in data and IT systems. Platforms for data aggregation are likely to be a prime candidate at many firms, but the degree and type of investment will vary by firm.

Some banks have been able to leverage stress testing off existing infrastructure. For example, at TD Bank Group, people, processes and technology for capital quantification, measurement and reporting have been aligned to handle the load, the bank says. Other banks, such as UBS, have made major investments, with the Swiss bank noting that it is nearing completion of an 18-month overhaul of its risk-measurement calculations, aimed at improving their accuracy, granularity and comprehensiveness, as well as decreasing the time taken to produce firmwide scenario-consistent stress test results. (See box below)

Perhaps the biggest factor creating strain on banks’ systems is the need to run not only internally-generated tests both firmwide and for specific product areas and geographies, but also myriad tests mandated by regulators from multiple jurisdictions with different assumptions and concerns. Guidance from local regulators, the Bank for International Settlements (Basel), the FSA, the European Banking Authority, and/or the Federal Reserve Bank, can differ substantially.

Data must be presented in a manner that is valuable to the end user, which can be tough when regulators request a format that may not be useful to the executive team managing the firm. A good example occurred last year when the Federal Reserve Board gave large financial institutions one month to submit data in defined templates for multiple business lines of products that also had to be reconciled with regulatory reports.

Similarly, the rising regulatory demand for stress testing by legal entity often is at odds with the group-as-a-whole approach banks may be using operationally for risk management, treasury and/or liquidity management. “Historically our stress testing has been done on a global basis. The challenge is that we are being asked more and more to provide stress testing at a legal entity level. In some areas, from a risk management perspective, we don’t look at it that way,” says Patrick McKenna1, chief risk officer for the US for Deutsche Bank. So rather than using the single obligor principle to aggregate a particular borrower’s credit exposures regardless of where the business was booked, banks may be unraveling exposures by legal entity. As for treasury and liquidity management, financing might no longer be viewed on a group-wide basis.

UBS invests in infrastructureOver the last 18 months, UBS has made major investments in its infrastructure for stress testing. One of the biggest projects has been an overhaul of its risk-measurement calculations. “The systems and data issues associated with doing that are pretty significant,” says Darryll Hendricks, head of investment banking risk methodology at UBS.

The bank says that it has adjusted systems so they can handle different time horizons for different market positions based on their associated liquidity. The bank believes this lets it deliver one horizon for pure directional risk and another, longer, time horizon for the so-called “basis” risk between different types of instruments exposed to similar risk factors. UBS can specify shocks geared towards varying exit time frames and likely respond more quickly.

The bank has also built and implemented a simulation methodology with the computational power to capture both the market and counterparty risk from a particular stress scenario. Over the last year, notes Mr. Hendricks, as UBS was conducting stress tests around Europe, this helped offer a more complete picture of the potential fallout from a hypothetical Greek default, including its own exposure to Greek bonds and credit derivatives, as well as its exposure to other banks and counterparties that might be affected.

The bank says it has also almost finished a project that will allow it to derive stress test results for more complex positions, such as exotic derivatives, from a full revaluation of positions taken from the front-office systems for these trading books. The result is expected to be more reliable estimates of the impacts from sensitivities to multiple factors such as interest rates and foreign exchange rates when there are extreme moves by both. Implementation required cooperation between risk, IT, trading desks and quantitative experts in the front office who support the trading desks.

Indeed, in all of the changes that UBS has made, collaboration across the organization has been crucial. “It takes time and effort and discussion across many different stakeholders,” Mr. Hendricks says.

Many banks have been tightening and clarifying their management structures around risk management and stress testing. One of the goals is to have more consistent scenarios and assumptions across the organization in order to avoid duplication and the possibility that each group might run tests that are not integrated into the whole.

Reporting structure: Stress testing is generally run out of the risk- management group, with input from finance and business lines. There are many permutations on this theme, however.

According to Canadian-based TD Bank Group, it uses an integrated reporting structure where enterprise-stress testing sits within risk management and reports to Manjit Singh, SVP of Capital and Finance. When it comes to his responsibilities as head of the bank’s overall capital requirements and stress testing, he reports to the CRO. Otherwise, he notes, he reports to the Treasurer and to the CFO respectively for his other roles as head of financial forecasting and planning and as head of capital availability and adequacy. One of his direct reports runs economic capital and stress testing. The team produces a financial plan in sync with its capital plan and overlays stress testing impacts. “From my perspective, it is quite useful to see all of that coming together into an integrated plan,” he says.

According to HSBC North America Holdings, a unit of HSBC Holdings, stress testing falls under the purview of its risk-strategy function, a member of which sits on a stress-testing governance committee along with senior risk officers representing the different types of risk. This committee agrees on scenarios, evaluates results and oversees a working group that coordinates between subject-matter experts and the businesses. Outcomes ultimately flow to the local capital, risk and board audit committees and to the global risk function at the parent company, the bank notes.

Scenario development: Worst-case scenarios, in particular, must be credible and make sense. Running countless scenarios is time consuming and unless they are well chosen the results may be irrelevant to managing capital or the business. “You have to balance what kinds of scenarios and the number of scenarios,” says Mr. Siddique of Deloitte. “You also should address whether this effort is institutionalized, done in a systemic manner, and well ingrained in the risk-management culture.”

Centralized scenario development is being increasingly adopted to drive consistency and usefulness. Fifth Third Bancorp, for example, says it has taken this approach by imposing a formalized framework around stress testing and scenario development, (See box on page 5) as has Deutsche Bank.

Deutsche Bank says it has a new, more-comprehensive firmwide framework for stress testing processes and governance, under which scenarios for individual regions, businesses and risk groups are developed and scrutinized at the group level under the aegis of the group CRO. A group-wide governance board meets regularly to consider the impact on the income statement and on capital with input from group-wide capital and risk committees as well as from the business lines. “We have set up the governance to assure that we are consistently applying the same downside scenarios across different stress tests,” says Mr. McKenna.

Scenario creation also should be a team effort, with people from different disciplines across the company weighing in. This helps with buy in from businesses and management. According to TD, people across the spectrum of risks identify key vulnerabilities based on parameters set by the risk group. Next, the business line CFOs weigh in with concerns and the bank’s economics group adds key economic variables.

RBC says that its stress-testing working group meets monthly to spark an exchange on scenario development on issues ranging from the topical, to how to get an integrated view of specific events, to how extensively to run line-of-business or portfolio-specific tests. Additional scenarios might also arise from weekly meetings between the CRO and his direct reports, from regulators, from the senior management or from the board risk committee. The latter also reviews the selection of scenarios for yearly enterprise-wide stress testing that drives the capital management and capital planning program. “At the board level, they are quite interested in understanding how this works. It links relatively well into risk-appetite discussions,” says Morten Friis, CRO at the Canadian-based bank.

Banks might also keep in mind that Basel-driven ICAAP stress testing, with its focus on macro-economic shocks, is only one piece of what comprises a comprehensive and integrated approach. “It is valuable. It is important, but it is only one more parameter for management action, board oversight, governance and regulatory transparency,” says Mr. Friis. He notes that his focus is on having a broader array and greater frequency of directionally meaningful, but less-precise and comprehensive tests on both enterprise-wide scenarios and line-of-business portfolios. The aim is to better understand pressure points in individual books based on the bank’s own concentrations and vulnerabilities.

Assessing stress testing as a practical risk management tool 5

Governance

Fifth Third Bancorp setting the frameworkFifth Third Bancorp says that it has implemented a formal process that spells out the different aspects of stress testing, from what it will test to how it will use the results. Risks have been defined and frameworks put in place for such things as capital contingency planning and risk appetite. “In the recent crisis, what caught the banks by surprise was that they had not put in place a formal protocol for having enough capital to withstand such an event,” says Mary Tuuk, the bank’s CRO.

Fifth Third notes that it has a dedicated team for stress testing that combines resources from risk, finance and lines of business and works quarterly with capital and risk management committees as well as the board. Its goal is to help ensure that the bank is proactive in its capital planning. To this end, the bank says, stress tests and scenarios are developed to capture potential vulnerabilities to the bank’s business model and capital. Quarterly risk assessments are also considered in developing stress tests and scenarios. General economic factors, industry trends and natural disasters are considered. Industry benchmarking helps keep scenarios plausible.

According to the bank, test results are presented to the board and management in a manner that shows how the capital might be affected by a particular scenario and what could be done to correct the situation. The impact on capital is described in terms of risk appetite and regulatory-capital ratios relative to target ratios. The capital-contingency framework then spells out a range of mitigating actions the board and management might need to take in response to stress testing results. “If we are not meeting acceptable ranges on capital ratios or risk appetite, then the capital-contingency framework walks us through a decision tree on what to do,” says Ms. Tuuk. “There are a lot of ways that you can affect the outcome: raise more capital, take less risk or engage in a different strategy relative to capital levels.”

Frequency: As stress testing becomes a more entrenched risk-management tool that regulators rely on more heavily, demand for firmwide tests is likely to grow. Already, Swiss regulators mandate quarterly tests from their banks, and other regulators may not be too far behind. “If stress testing is well integrated into the risk-management infrastructure, it may be like looking at an asset-liability report,” says Mr. Siddique of Deloitte.

Indeed, Swiss-regulated Credit Suisse notes that firmwide stress testing needs to be a regular exercise for the results to be actionable. “It has got to be more frequent if you want to actually use it,” says Balbir Bakhshi, Head of the Market Risk Group at Credit Suisse.

For now, many banks run firmwide tests once or twice a year, along with daily stresses of trading portfolios, monthly ad hoc tests of particular portfolios or risks, and periodic tests for one-off occurrences of operational and other rarer risks. Add different stress tests for multiple regulatory jurisdictions, and it should be clear that producing results on schedule is a tall order.

Fifth Third says that it uses a quarterly operating cycle. Twice a year it fully stresses the income statement and balance sheet using a two-year time frame and typically three economic scenarios with different probabilities. In the off quarters, it tests various parts of the business, usually for credit risk. “The holistic stress tests are time consuming, involve a lot of people, and are not done easily on a dime,” says CRO Mary Tuuk.

According to TD Bank Group it takes about three months once a scenario is formally approved to quantify all the various segments, including stress impacts on both earnings and capital, and then for the stress-testing group to aggregate results and add perspective for the board. “The challenge is mostly around timing and the aggregation of all this information,” says Anand Borowake, vice president of risk management. TD also conducts periodic testing on specific scenarios that arise during the year.

HSBC North America Holdings says that it currently runs two strategic stress test cycles a year for business and capital-planning purposes. Each cycle contains four or five scenarios to ascertain balance-sheet sensitivities and involves the businesses at each stage over a six-week period. The risk strategy unit also runs more frequent, targeted tactical tests, which typically take a couple of weeks, “Extracting the relevant data from our data warehouse at month end is a relatively straightforward process. The real issue is integrating the holistic approach with the business teams,” says Mark Gunton, CRO of HSBC North America Holdings. The selection of the unit’s scenarios is coordinated with the parent bank, with one or two being group led.

6

Firmwide stress testing should consider a broad array of risks, including market, credit, operational and liquidity risks. In each area, tests should consider capital allocation and planning and key risk drivers and assumptions should be identified carefully.

Market and credit risk: Many of the banks actively deploying the technique spend the bulk of their time stress testing market and credit risk, partly because these are often their main risks and partly because quantification can be easier.

Even when risks can be easily quantified, qualitative judgments remain crucial. “You cannot blindly rely on good models even if you have good data, because in loss estimating, particularly on the credit side, and even on the trading side, there is a judgmental component that should not be neglected. It is very important to have very good quantitative modeling methods overlaid with good experience and judgment,” says Mr. Siddique.

In the credit-risk arena, data gaps and matching business exposures to the way that information is reported to regulators make the challenge particularly tough, and aggregation is an additional hurdle. “It is not just getting accurate and consistent variables, but also getting the right kinds of variables for estimating losses reasonably. To do that, you really have to work with the risk management and lines of businesses because the lines of business folks often understand credit better than most,” says Mr. Siddique.

According to RBC, its business mix, with sizeable portfolios of Canadian residential first mortgages, other North American commercial and residential real estate and commodities, means that among the important risk factors it monitors are credit spreads, interest rates, foreign-exchange rates, commodity prices and economic growth in key markets. Recent stress tests, it notes, have included a look at western Canada’s vulnerability to a residential real estate downturn and the impact of $150-a-barrel oil prices on a sustained basis on key markets, businesses and customers. Stress testing also offers a way for the bank to monitor potential credit-risk concentrations. TD says it tests for potential credit losses in its large retail banking business using interest rates, house and real estate prices and unemployment as risk factors.

Deloitte’s Global Risk Management Survey 2011Deloitte recently published the latest edition of its Global Risk Management Survey, with 131 participants globally. The sample included some asset managers and insurers, but the majority of participants were banks or integrated financial institutions. The findings relevant to stress testing were as follows:

“The portion of institutions that conducted stress testing monthly or less often is 47 percent for the trading book and roughly three quarters each for the banking book, the structured products book, and counterparty exposures. The most common usage of stress testing was at the overall enterprise level, employed by 85 percent of institutions. At the enterprise level, it is typically easier to employ top-down stress testing, which employs broad assumptions to examine balance sheet assets and to stratify loan books into different categories based on loss experience for consumers with different credit levels. However, a bottom-up approach may provide more detailed results and offer insight. Many institutions also reported conducting stress testing at lower levels, e.g., 81 percent for individual portfolios and 70 percent for individual business units.

Thirty-four percent of institutions conducted reverse stress testing. The use of this approach was higher among large institutions, where 48 percent reported using it.

Almost all institutions used stress testing to report to senior management (90 percent), to report to the board of directors (88 percent), and to understand the institution’s risk profile (87 percent). Most institutions also used stress testing in responding to enquiries from rating agencies and regulators (80 percent), triggering further analysis (80 percent), setting limits (76 percent), and conducting strategic planning (65 percent).”

Assessing stress testing as a practical risk management tool 7

Stressing for different risks

To get a good grasp of the credit or counterparty risk in its trading and loan books, Deutsche Bank says that it reviews each industry sector in detail across the bank at least once a year, looking at key drivers, strengths, weaknesses, what’s happening in the market and the underlying portfolio. It runs a stress scenario to determine losses from events such as a two-or-three notch ratings downgrade of the portfolio and changes in the loss-given default with varying recovery assumptions. Deutsche says it also stresses its derivatives holdings on a monthly basis, calculating where the portfolio could move in terms of mark-to-market values under various scenarios and/or sensitivity analyses.

Operational risk: Operational risk—which can include such risks as fraud, operations failure and one-time low-probability disasters such as the recent Japanese earthquake, tsunami and nuclear impact—lends itself well to a scenario and stress testing approach. Although they are inherently difficult to quantify, these risks should be considered, as they have the potential to bring down the bank.

Even so, the task is not easy, given a lack of data and the difficulty of aggregation. It demands a mix of quantitative and qualitative skills. Often, an operational risk itself might be used as the basis for a scenario for firmwide stress testing, although caution must be exercised in selecting realistic worst-case scenarios. Complications arise because this type of risk tends not to be linked in obvious ways to economic factors. In some cases it impacts or overlaps with other kinds of risk, which can create double counting.

Measuring the potential impact of operational risk is a process that includes the identification of key risk drivers and then an estimation of how operational risk losses might be incurred under certain scenarios. This can vary by bank, not least because banks look at operational risk differently. The likelihood of losses under a difficult environment can be expressed in terms of such a loss not exceeding X dollars.

Different banks take different approaches, and notwithstanding progress in applying mathematical methodologies, subjective, qualitative judgments are unavoidable. “With operational risk, the real challenge is that you have much less basis on which to judge and estimate the risks and the stresses,” says Mr. Hendricks of UBS. “You can imagine certain kinds of activities or events that could cause a substantial loss, but it’s very difficult to have a precise sense of how likely some of those events are.”

TD says it focuses firmwide stress testing on operational risks that occur in the context of economic scenarios that are systemic in nature and hence more actionable, rather than on the effects from unlikely one-time events. Thus, the impact of the failure of a large ATM provider on controls and recovery plans might take precedence over an earthquake, although last year the bank did run an ad hoc test on the potential impact of an earthquake in British Columbia to see if its existing capital levels would hold. At Credit Suisse, various metrics help the board to monitor the strength of the bank’s operational-risk controls. For capital purposes, the bank notes, a modeling technique that is a cross between a scenario-based technique and a portfolio-modeling technique calculates a number for operational risk that can be used as a capital number.

Deutsche Bank says it does event stress tests for operational risk, looking at internal and external data simulations to derive the impact on the business and on potential losses, be they legal reserves, fraud or operational losses. The bank’s operational risk model uses actual historic losses to determine what economic capital should be set aside for a particular business, rather than the scenario analysis adopted by some other banks, although it still runs scenario analysis.

Liquidity risk: Regulators are taking a stricter view of liquidity risk and demanding that it become a more routine part of stress testing. The goal is to make sure that liquidity targets are met and, if not, that remedial action is taken.

Like operational risk, liquidity risk can be hard to quantify due to a lack of data and the difficulty of aggregation. Some banks, such as TD, integrate liquidity risk into their firmwide stress testing, while others may not. Although liquidity risk in stress scenarios is assessed independently as part of ongoing liquidity risk management, TD says it incorporated and integrated liquidity risk for the first time last year in its enterprise-wide stress test program. Starting from its conservative liquidity risk appetite, under which it matches most of the maturities for its assets, TD says it looks at what market conditions might prevail in a stress scenario with respect to availability of liquidity sources (wholesale funding, securitizations, deposits) and how it could respond.

Some banks consider the time span of a risk scenario and examine whether there is sufficient liquidity to weather the duration of the problem. According to Deutsche Bank, its treasury group runs liquidity stress tests under which it looks at the impact on its net liquidity position under two scenarios—one lasting eight weeks in which Treasury continues to provide funding up to regularly assigned funding limits, and a second lasting one year in which, after the eight-week horizon, balance sheet reduction measures are undertaken. The bank says it assumes in both these scenarios that some sources of short-term funding might not roll in whole or in part, and also assumes that new liquidity drawdowns take place. The result of this analysis drives the size and composition of liquidity buffers that could be tapped into in extreme circumstances to provide liquidity for the two time periods.

8

Assessing stress testing as a practical risk management tool 9

With regulators, notably the FSA, asking for reverse stress testing, many banks may be called on to follow a practice for which they currently may see little utility. The idea of starting with an unpleasant outcome, such as the failure of the bank, and then coming up with scenarios that cause this dire result strikes some risk managers as a questionable use of time.

That said, many agree that the process of reverse stress testing forces risk managers, management and boards to think more imaginatively when it comes to rare but lethal events and to rely less heavily on quantitative models and summaries. “We do see some merit in using reverse stress testing because it stimulates a good strategic-risk discussion. It is a simple and very powerful concept if you don’t over-engineer the actual analysis or parameters,” says Mr. Bakhshi.

Reverse stress testing provides a way to focus on forward-looking stresses and look at potential outcomes that have not been seen before but could happen. It is a tool that could help keep management focused on risk when boom times return. On a more immediate and practical level, reverse stress tests can point out areas where a bank might need to revise and enhance mitigation and contingency plans, rethink business volumes or add to capital.

Regulators are pushing banks to be more than purely qualitative in their approach. They want quantitative methods applied, with a resulting calculation or articulation of what combination of market movements and other events might result in changes in values. So far, UBS says it has tended to apply reverse stress testing as a more severe version of stress tests themselves and has grappled with the need to have a systematic method for coming up with plausible scenarios so that results will be more meaningful. “The problem is that it sounds good in theory, but in practice, it requires a lot of judgment. Ultimately it is a highly subjective exercise and so that is in part why I think it’s still very much a work in progress,” says Mr. Hendricks.

Deutsche Bank says that it uses what it calls a benchmarking method, looking, for instance, at what it might take to breach its minimum Tier-One capital threshold. To this end, it examines aggregate worst-case scenarios across the firm. TD says it uses both top-down and bottom-up approaches. Under the former it would look at a hypothetical scenario such as a deflationary environment. Under the latter, it would look at existing vulnerabilities across the various businesses and risk categories and aggregate them into a holistic view assuming all the worst-case shocks.

Reverse stress testing: Coming soon

10

To be useful as a tool for assessing a bank’s capital needs, a stress testing process should carefully consider the plausibility of the chosen scenarios. It is also important that the process is assessed for how well it is integrated with an institution’s risk-management culture. It cannot be conducted in isolation from a bank’s strategy and risk appetite, particularly if it is intended to help drive capital allocation and business decisions.

A particular bank’s risk appetite can be crucial in responding to scenarios. The board ultimately decides if a scenario is within its tolerance for risk and therefore whether it might need to provide extra capital. That means banks need to be explicit about their risk appetite, which can be expressed qualitatively or quantitatively. Some banks specify a target credit rating. Risk appetite can also be identified through such measures as earnings-at-risk and economic capital and managed by setting limits on activities. Stress testing for these metrics can help monitor any divergence, prompt discussion and, if a limit is breached, compel action.

If stress tests results are to be actionable, then clear and consistent communications, including possible responses, should be considered by the board and management. “The key around stress testing is to keep it simple. If you keep your definition of what stresses you’re doing simple, then you will have a better discussion around whether you are happy with the numbers or not. The discussion can increasingly focus on being forward looking,” says Mr. Bakhshi.

Reports generally are both qualitative and quantitative and list formalized mitigations, including such actions as hedging, cutting exposures, exiting businesses, boosting capital allocations, changing strategies, and/or building capital by cutting dividends and reducing buybacks. More relevant discussions, and greater executive team and board interest, tend to be prompted if the focus is not on an overly technical explanation. “The key is trying to make sure you’re seeing the forest for the trees,” says Mr. Hendricks of UBS.

To provide useful information to its board and senior management, TD notes that it compares stress testing results to its risk appetite to see if it is breaching any of its risk-appetite statements, which would suggest the need for some kind of mitigation or pull back. It then looks at potential losses against capital and shows how TD might compare to its peers.

Knowing what to do in response to stress tests results has several dimensions, notes Tim Thompson, a partner in Deloitte LLP (UK). “We have seen potentialmanagementactionsconsideredatbothabusinessunitandgrouplevel.Businessunitactionstendtoberelativelytactical–forexample,changing behavioral scorecard origination cut-off points to manage credit assets or customer rates for liabilities. At group level, banks tend to consider more strategic actions such as divestments and capital raisings.”

In terms of ongoing use of stress test calculations as a management tool, banks have been developing in two main ways, notes Mr. Thompson. Where historic information regarding the impact of management actions is available, then analysis and documentation relies heavily on this experience to evaluate future impacts. However, where there is limited experience then the impacts are debated by senior management within a formally governed process to support rigor behind management judgement. “In our experience, it can be important to consider the impact of potential management actions in the context of both the economic environment under the stress scenario, and also in light of the expected actions implemented by peers in the scenario,” notes Mr. Thompson. Peer interactions can become critical variables in stressed environments, so anticipating peer behavior is an additional complexity in the process.

Good documentation of procedures can also be essential, so that senior teams know exactly what actions could be considered in potential future circumstances and what the desired impact of these management actions might be over what time frame. These actions also could be supported by a credible range of trigger points aligned to key leading risk indicators, for example delinquency rates or operating margins. This can help ensure that management actively reviews lead risk indicators and is therefore more likely to put actions in place in a timely manner. Further, senior management can review the efficacy of any documented actions, while the list of actions and associated triggers can be included explicitly in executive committee and board risk reporting.

Results: From testing to management

Assessing stress testing as a practical risk management tool 11

It looks as if stress tests are here to stay as part of the regulatory tool kit. As they gain more traction, tests are likely to be requested with greater frequency and be subjected to ever greater scrutiny. The approach to stress testing has evolved, with much greater use of enterprise-wide stress testing approaches and macro-economic inputs. Reverse stress testing is an additional approach to identify stress scenarios and events of concern. Regulators are likely to demand ever more data to develop loss estimates of their own and ask ever more probing questions about processes for developing internal models, scenarios, and stress tests.

To come up with a credible model and process, quantitative experts may need to take a more collaborative role as part of a team comprised of risk, finance, capital management, treasury and business lines. “It is not just about modeling, it is about having a good risk-assessment estimation process,” says Mr. Siddique of Deloitte. That means remembering that assumptions and scenario selection can be inherently judgmental, inaccurate and not necessarily precise. “The goal is to get a decent balance between sophistication of analysis and variety of scenarios, with the understanding that it’s the directionally meaningful interpretations that are the most important. The fourth decimal point accuracy on impact on capital ratios or net income in a specific scenario is not that interesting or important,” says Mr. Friis of RBC.

Banks should also consider ways to incorporate into business decisions the idea that things can go very counter to current assumptions. Getting into the habit of having regular discussions between functions can help, but there is no magic formula to make this happen. “You have to foster a culture where people are open to changing their minds about things, where it is normal to challenge assumptions and think about, what the world would look like if things that we think are somewhat unthinkable really did happen,” says Mr. Hendricks of UBS.

To succeed, stress testing cannot be done in a vacuum. A strong risk culture is crucial. And the messaging needs to come from the top.

Conclusion

12

Contacts

This white paper was researched and written for the Deloitte Center for Financial Services by Alison Rea, former US banking correspondent at Reuters and former US Editor of Strategic Finance, an Economist Group publication.

To learn more please contact:

Sabeth SiddiqueDirector, Deloitte & Touche LLP+1 202 378 [email protected]

Ed HidaPartner, Deloitte & Touche LLP+1 212 436 [email protected]

Tim ThompsonQuantitativeRiskPartner–RiskandregulationDeloitte LLP (UK) Tel +44 [email protected]

Insights. Research. Connections.

Headquartered in New York City, the Deloitte Center for Financial Services provides insight and research to help improve the business performance of banks, private equity, hedge funds, mutual funds, insurance and real estate organizations operating globally. The Center helps financial institutions understand and address emerging opportunities in risk and information technology, regulatory compliance, growth, and cost management.

The Center brings a financial services integrated view to Deloitte and its network of member firms, each of which is a legally separate and independent entity that provide audit, consulting, financial advisory, risk management, and tax services to select clients.

With access to the deep intellectual capital of 169,000 people worldwide, Deloitte serves more than one-half of the world’s largest companies, as well as large national enterprises, public institutions, locally important clients, and successful, fast-growing global growth companies.

To learn more about the Center, its projects and events, please visit us at www.deloitte.com/us/cfs.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte, its affiliates, and related entities shall not be responsible for any loss sustained by any person who relies on this publication.

As used in this document, “Deloitte” means Deloitte LLP and its subsidiaries. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.

Copyright © 2011 Deloitte Development LLC. All rights reserved.Deloitte Touche Tohmatsu Limited