Internal Ratings: Leveraging ERM For Regulatory and Business Value Enterprise Risk Management Symposium Concurrent Session: A5 Christopher Whalen Managing.

Internal Ratings:Leveraging ERM For

Regulatory and Business ValueEnterprise Risk Management Symposium

Concurrent Session: A5

Christopher Whalen

Managing Director

Institutional Risk Analytics

May 3, 2005


How to Leverage ERM?

• Control your data by structuring internal and external information using industry standards such as XML/XBRL. Get good peer, customer data.

• Control your business by imbedding risk analytics tools and performance metrics into all aspects of management process.

• Control your disclosure by displaying your financial results, performance and risk metrics using same structured data and benchmarks.


ERM Themes

• Mark to Model: For banks, regulators are aligning risk creation and control responsibilities under a portfolio-based discipline that rewards modeling skill, execution and risk avoidance.

• Internal Controls: For all companies, onus is O&Ds to maintain internal systems that track how risks are taken and mitigated, document extraordinary events, and make disclosure timely and accurate.


Interweaving Regulations

Basle II:• New Capital Accord

focuses on credit and operational risk. All performance and risk factors must all be quantified and projected via an internal ratings process that is transparent and documented.

Sarbanes-Oxley:• Regulatory response

to corporate fraud and management failures. Mandates normative roles for O&Ds, auditors and counsel in review and disclosure process to assure adequacy of internal operational and financial controls.


Op-Risk Event Horizon

External Factors

Market/Credit/

Business Risk

OperationalRiskInternal

Factors

Visible to Management

Not Visible toManagement


Risk Segments

• External: Those factors beyond the horizon for management. Utilize macro economic, actuarial and other indicators to monitor/price these invisible risks.

• Internal: Those factors that may be directly observed by management. Utilize internal financial, op-risk metrics to benchmark business and validate controls.


Op-Risk Factors

Market/Credit/

Business Risk

OperationalRisk

• Act of God

• Execution

• Terrorism

• Fraud

• Diligence

• Strategy

• Competitor

• Investment

• Vendor

• Market

• Ethics

InternalFactors

• Governance

• Technology

• Systems

• Procedures

• Counterparty

• Counterparty


Risk Opinion Components

• Absolute Tests– Patterns that indicate elevated vulnerability

to potentially catastrophic events.

• Sudden Motion Tests– Sudden deviations from past behavior or

extreme volatility in behavior.

• Outlier Behavior Tests– Statistically significant deviations from

industry peers.


Indicator Limitations Credit Analysis

Most credit/risk ratings are based on liquidity models that depend on market prices (EMH) that are vulnerable to manipulation by market makers. Quarterly tie-outs to as-reported fundamentals are not mandatory. While useful for momentum investing, Merton models provide little if any forewarning of fraud and/or restatement.

Behavioral Analysis

Behavioral indicators provide visibility into areas where credit ratings do not cover, but also frequently miss events actually detected by Merton models! Low correlations and high false positive rates vs. historical event distributions suggest additional validation needed to achieve a defendable degree of confidence for SOX and/or Basel II compliance.


Modeling Alternatives

• Path 1: Modify Existing Credit Models to Cover Outlier Behavior Risks– Addition of new factors then recalibration of Regression-

Scoring Models.– New modeling to account for “market inefficiency” risk to

correct assumptions of Merton models.– Firm Specific Event Risk Modeling for Cash-Flow

Simulations.

• Path 2: Add a specific behavioral risk profile to capture and score subjects exceeding profile boundary.– Add specific fundamental factors to risk rating profile.– Create/maintain fundamental profile to demonstrate

diligence regarding operational factors.


Ratings System Design

AgencyPolicy

Statements

Academicand

IndustryTreatments

Selection ofTest MethodsAnd Metrics

LegalFilingsSourceData

Numerical Benchmarks

Temporal Trends

Peer ComparisonsObjective: select a test set that covers the relevant risks.


The Ratings Game

• To validate any risk management system, must benchmark projections against actual.

• Advantage of a common approach to risk taking and risk management is that business performance becomes expression of both.

• By examining financial performance in detail, can assemble a profile of business and operational factors.


Ratings: Basel II


Basel II Bank Metrics

• Business Performance:– Profitability, productivity, solvency; actual vs.

projected vs. peers.

• Credit Risk Factors:– P(D), LGD, M, EAD in aggregate and by key lending

classes; actual vs. projected vs. peers

• Operational Risk Exposure:– Management decisions and external factors

generating out of “norm” events; actual vs. projected.


Summary Risk Profiles

(December 2004)Name Assets ROA ROE LGD P(D) WAM EAD RatingJPM $967 0.20% 3.23% 75.1 62.4 3.54 69.7 BB

Citibank $964 1.50% 18.80% 77.4 182.6 1.68 160.5 BBBOA $771 1.50% 21.20% 57.7 30.6 7.83 64.23 BBB

WACH $390 1.30% 14.10% 52.7 22.2 5.59 82.32 BBBSource: Federal Deposit Insurance Corp/Institutional Risk Analytics

Basel II: A qualifying IRB rating system must have two separate and distinct dimensions: (i) the risk of borrower default, and (ii) transaction-specific factors.


Basel II Risk Modeling

ActualValue

IRB Model Predictionfalls within target range.

Performance“Norm”ToleranceLimit

Excessive deviation triggers PCA to recalibrate IRB modeling system.


Basel II Credit Metrics

Layer 1

Revised Standardized

Approach

• Relies on external ratings based on borrower category.

• Provisions for added risk sensitivity weight factors.

Layer 2

Foundation IRB

Layer 3

Advanced IRB

Probability of Default (PD)

Internal Bank Estimate

Internal Bank Estimate

Loss Given Default (LGD)

Supervised Factor Internal Bank Estimate

Maturity (M) Supervised Factor Risk Weight Adjustable

Exposure at Default (EAD)

Supervised Factor Internal Bank Estimate


Mark to Actual

• Use enhanced internal metrics to set up a closed loop assurance function to ensure that bank IRB systems that rely on forward projection statistics are marked to actual.

• Control loop can be used both internally by risk officers and auditors, and externally by regulators, to ensure a healthy system of checks and balances.


Macro Implications

• Basel II credit risk reporting factors will become a de facto standard for comparing all banks among credit analysts and buy-side investors.

• Basel factors will be used to streamline regulation, explain operating policy, and facilitate peer comparisons. Banks will rate themselves in real time vs. Basel projections.

• Periodic reporting will eventually move to monthly frequency. Internal systems will “mark to actual” vs. real time call report.


Basel II: M&A EffectLarge Bank Peer Group -- LGD

40.00

50.00

60.00

70.00

80.00

90.00

100.00

1999

03

1999

06

1999

09

1999

12

2000

03

2000

06

2000

09

2000

12

2001

03

2001

06

2001

09

2001

12

2002

03

2002

06

2002

09

2002

12

2003

03

2003

06

2003

09

2003

12

2004

03

2004

06

2004

09

2004

12

JPMCitibankBOAPeer Avg


Macro Implications

• Bank risk estimation methods will be benchmarked and certified against legal filings of periodic regulatory reports, providing a very clear and very public measure of performance.

• Prompt corrective action (PCA) to eliminate excessive deviations between models and filings will become a key regulation mechanism.

• Institutions that excel at execution and managing the rate of external events will win the competitive race.


US Bank National AssociationP(D) (cumulative by year through 12/04)

0

20

40

60

80

100

120

140

160

180

1999-03 1999-12 2000-09 2001-06 2002-03 2002-12 2003-09 2004-06

Bank Unit

Peer Avg

Basel II: P(D) Profile


Ratings: C&I Profile


Selected C&I Metrics

• Business Performance:– Profitability, productivity, solvency, actual vs.

projections, and vs. peers.

• Risk Factors:– Behavioral analysis, earnings & assets quality, long-

term business and competitive trends.

• Operational Risk:– Quality of management decisions and external factors

generating out of “norm” events, audit, governance.


Summary Risk Profiles

C&I Rating Factors12/31/2004 Solvency Debt Service Gross Margin Sales Growth Z-Score RatingF n/a n/a Downturn Unstable Danger BBB-GM n/a n/a Stable Stable n/a BBB-DCX Solvent Marginal Stable Stable Danger BBB+TM* Solvent Adequate Stable Stable Warn AAA* 3/31/04

Source: IRA Corporate Monitor/CoreData/S&P

Based on the assessment of these and other factors, the risk manager may then assemble an independent rating for the subject companies.


C&I Profile

Visteon Corporation(millions)

Source: IRA Corporate Monitor/CoreData

2004 2003 2002 2001 2000Net Income -1,489 -1,213 -352 -118 270EBITDA -438 -454 550 548 1,337Solvency SOLVENT SOLVENT SOLVENT SOLVENT SOLVENTDebt Service MARGINAL MARGINAL ADEQUATE ADEQUATE ADEQUATEAsset Qual DECLINING STABLE STABLE STABLE STABLEZ-Score N/A WARN OK OK OK

Based on the assessment of these and other factors, the risk manager may then assemble an independent rating for the subject companies.


Analytical Challenges

• There are 20 million companies in the US, but only 15,000 are public.

• Credit officers frequently rely on “mutual revisions” rather than maintain informed, independent credit opinions, especial on “in-betweens.”

• Must extend range of default prediction tools from current 20% probability to 50%, in particular to detect fraud, restatement.


The “In-Betweens”


ERM Challenges

• Structuring the collection and warehousing of information including the migration and sweetening of existing historical data.

• Achieving Advanced IRB compliant end-to-end risk analysis systems deployed at enterprise level by the 2007 date for Basle II start.

• Workable expense containment strategies that increase rate of data throughput and analysis, but lower “per transaction” cost.


Who is Institutional Risk Analytics?

• IRA is part of a movement within the financial analytics community to broaden risk measurement tools to include behavioral elements described by fundamental factors.

• IRA builds customized risk systems for processing public & privileged data, and publishes research on companies and topics affecting financial policy & regulation.


Contact Information

Corporate Offices

Lord, Whalen LLCdba Institutional Risk Analytics14352 Yukon AvenueHawthorne, California 90250Tel. 310.676.3300Fax. [email protected]

WEBSITE:www.institutionalriskanalytics.com

For inquiries contact,

R. Christopher Whalen

Managing Director

Head of Sales and MarketingTel. 914.827.9272

Fax. 914.206.4238

Cell. 914.645.5304

[email protected]

mailto:[email protected]

http://www.institutionalriskanalytics.com/

mailto:[email protected]

Internal Ratings: Leveraging ERM For Regulatory and Business Value Enterprise Risk Management Symposium Concurrent Session: A5 Christopher Whalen Managing.

Documents

risk creation

risk avoidance

oprisk metrics

imbedding risk analytics

management slide

internal controls

internal systems

internal ratings process