Basel II for smaller ADIs ICAAP Calculations Key Drivers

1. AFIAA Conference - May 2008 Basel II for smaller ADIs ICAAP Calculations Key Drivers David Bergmark Protecht Advisory

2. Objectives To Understand: • Overview of ICAAP requirements • Understand what an “ICAAP” process involves • How to quantify the Prudential Capital Requirement (PCR) uplift factor • What “document the process” means? • The need for “comprehensive review” and the role of the auditor • Things to look out for in ICAAP

3. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

4. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

5. ICAAP Under the new Basel II regime, the new APS 110 standard “Capital Adequacy” requires all ADIs to: “have a process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels”

6. Objectives of ICAAP To ensure ADIs have adequate capital to support all the risks and to encourage ADIs to develop and use better risk management techniques in monitoring and managing their risks Internal independent view of the risks of the ADI and the capital required to support them and allows APRA to compare their assessment with ADI’s It’s the Journey, not just the Destination PROCESS

7. ICAAP Features • The Framework establishes five main features of a rigorous ICAAP as being: • Board of directors (Board) and senior management oversight; • sound capital assessment; • comprehensive assessment of risks; • monitoring and reporting; and • internal control review.

8. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

9. The ICAAP Process • Risk Identification and Assessment • Facilitate workshop with senior management and Board to identify and assess ICAAP risks • Consider assistance questionnaire that covers: • Identifying inherent risks • Identifying controls • Document risk assessment and produce overall risk analysis • Identify material risk that may lead to additional pillar 2 capital • Factor these together with existing risk quantification (eg. IRRBB) • Carry out integrated capital planning • Devise methodology for determining PCR buffer • Document and review whole process • Develop an ICAAP Policy, signed off by Board • Consider education requirements of Board and Management • Carry out benchmarking against other Mutuals

10. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

11. Capital Adequacy RatioPrudential Capital Requirement (PCR) APRA requires all ADIs to maintain a minimum capital ratio of 8%. Separate PCR’s will be set for each ADI proportional to each ADIs overall risk profile Capital Risk weighted assets

12. Prudential Capital Ratio • Required by APS 110 • Minimum ratio of 8%, at least 50% in tier 1 • APRA can set PCR above 8% • APRA can request tier 1 capital constitutes more than 50% of total capital • “APRA is currently in the process of reviewing ADIs’ PAIRS scores and ICAAPs and it is expected that PCRs will be communicated to advanced ADIs by the middle of the year and other ADIs during the course of the year.” • Katrina Squires – APRA: Credit Risk Management Conference 26 February 2008

13. Risks covered by Pillar 1 Credit Risk (Assuming a well diversified portfolio) Market risk for trading (N/A for Mutuals!) Operational Risk (Direct loss effects only)

14. “Comprehensive assessment of risks and internal control review” • Identify all material risks of the ADI • Identify the controls and mitigants over these risks • Assess the level of inherent risk (risk before considering controls) • Assess effectiveness of controls • Assess residual risk (after considering the effectiveness of related controls) • Assess extent covered by Pillar 1 • Consider need to provide capital under Pillar 2

15. Risks not covered by Pillar 1

16. Risks not covered by Pillar 1

17. Quantitative or Qualitative? “Pillar 2 inherent risk exposures are assessed quantitatively to the extent possible but, where risks are not readily quantifiable, supervisory judgment is necessary. Supervisory judgment is also necessary with respect to qualitative assessments of the ADI’s ability to contain actual risk exposures within prudent, planned levels through effective risk governance, oversight, management and control practices.” “Since these exposures and qualitative factors are generally not capable of quantification, or at least robust quantification, a degree of judgment about capital adequacy is required, including by supervisors”. “Strategic risk is very difficult to quantify” APRA

18. Pillar 2 Risks Quantitative or Qualitative?

19. Interest Rate Risk in the Banking Book • Interest Rate Risk can be measured in a number of ways including: • Gap Analysis • Earnings at risk (Accrual Simulation) • Economic Value Sensitivity (1 basis point - PVBP) • Sensitivity Stress Test (200 basis points) • Value at Risk • Framework calls for stress test to a parallel shock of 200 basis points. Where this results in a reduction in economic value of more than 20 per cent of Pillar 1 capital, ADI considered an ‘outlier’, for which extra supervisory attention is indicated. If ADI believes this standardised measure does not accurately reflect its true IRRBB exposure and, it should explain what alternative measures it believes are more appropriate and what results they produce. APRA will take these considerations into account in its risk assessment.

20. Interest Rate Risk • Use 200 bpt stress or Var/Capital % • For 200 bpt stress: • Only provide capital if result > 20% • Provide Capital at (say) 5%, 10%, 15%, 20% …. • How much? • For Var/Capital % • Provide actual VaR/Capital % as buffer • Actual Risk or Limit? • Provide if Var/Capital over certain threshold (say 2%, 4% …….)

21. Credit Risk – Concentration Risk • Large exposures • High correlation between exposures • Industry • Geographical • Customer demographics • Product characteristics (Reliance on same security type) • Correlated exposures are more likely to be impacted by the same adverse external developments, and to default at the same time. Other things being equal, the narrower the market focus of the ADI, the more correlated its exposures and the greater the risk relative to the size of its portfolio.

22. Credit Concentration • Concentration Risk - The HERFINDAHL index – measure of concentration • Compare concentrations with industry averages • Stress Tests - Project Panama: Increase in mortgage defaults and property price declines: • over a one year period, house prices decline by 30 per cent; and • mortgage defaults increase to an average of 3.5% (20 year average home mortgage default is 0.12 per cent a year.

23. Liquidity Risk The risk of incurring unexpected costs or losses in meeting financial obligations when they fall due. Caused by mismatch between the contractual maturities of actual (or contingent) financial assets and liabilities. Where contractual dates are mismatched, assumptions need to be made about the renewal / replacement of maturing liabilities, draw downs of outstanding commitments, or the ease of realising assets. These assumptions may prove incorrect. Costs may result from the forced replacement funding at higher cost or the forced realisation of assets at lower than value. The greater the mismatch, the greater the potential cost of having to generate alternative funding to cover that mismatch. APRA will review the ADI’s liquidity risk management policies, procedures and limits, and its actual liquidity risk profile.

24. Qualitative Everything else …… example • Strategic risk is very difficult to quantify but is nonetheless real, and potentially very large. At the least, APRA will need to satisfy itself that the ADI has tested its key planning assumptions under some pessimistic but nonetheless plausible business scenarios in order to demonstrate that it has sufficient capital to withstand adversity. • Solution • Carry out an analysis of all “qualitative” risks • Determine those that are “material” and potentially require additional capital • Carry out plausible stress scenarios • Determine overall qualitative contingency buffer

25. Strategic Risk • External risks which potentially affect the viability of the ADI from unexpected adverse changes in, or erroneous assumptions concerning: • Business environment with respect to the economy • Political landscape • Regulation • Technology • Social mores • Competitor action • The impact of this can be: • lower revenues (reduced demand for products and services) • higher costs • cost inflexibility • The risk factors to consider: • scale and diversification of business activities • capacity to respond to a changing environment.

26. Contagion Risks • The risk of association with members of a group or third party and may include: • Other credit unions and the “Credit Union” name • Industry support scheme if called upon • Related “associated” parties (Financial Planners, Car Buyers, Insurance, Travel Companies, Securitisation vehicles) • The impact of this can be: • Financial cost • Reputational damage

27. Other Risks • Everything not caught elsewhere !! • Regulatory and Compliance Risk • Other plausible events

28. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

29. Output of the ICAAP process ICAAP Policy Document Annual ICAAP Document - Documentation of the process Risk Assessment Questionnaire Capital Plan, Strategic Plan, Business Plan, Budgets – all linked Effective and comprehensive review of ICAAP on a regular basis

30. ICAAP policy • Objectives of the ICAAP process • Organisation structure • Responsibilities and delegations for ICAAP • Board • Senior Management • ICAAP process • Risk and Control Identification • Risk Assessment • Methodology for calculating PCR uplift factor • Sources of information and data • Capital Planning • Relationship to Strategy, Planning and budgeting • Documentation and recording – systems and format • Reporting • Ongoing monitoring of ICAAP • Audit / compliance and the ICAAP review process

31. Annual ICAAP Document • Content • Summary (Current and projected capital levels) • Background (Organisational and historical financial data, Nature and complexity of business, 1-5 year plans, strategies) • Risk Identification and Assessment (Results of assessment, material risks, risks covered by pillar 1, risks not covered by Pillar 1, How risks controlled) • Capital Adequacy (Amount of PCR contingency buffer and explanation of how derived) • Capital Planning (Link to capital plan, capital targets, how achieved) • ICAAP review (how reviewed, by who etc) • Use of ICAAP within the firm (Extent to which embedded in mutual and how used and understood internally)

32. Reporting ICAAP Assessment of Risk for ICAAP IRRBB Credit Concentration – Property Value Credit Concentration – Geographic Credit Concentration – Industry Strategic – Business Environment Strategic - Technology Strategic – Economic Contagion – Industry Contagion – 3rd party Liquidity – Large exposures Liquidity – Mismatch Liquidity – Large Deposits Liquidity – Fund stickiness

33. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

34. Auditors Role • Check the process….. • Workshop held to discuss risks? • Have risks that clearly exist been ignored? • Does the annual document include realistic capital forecasts? • Has the documentation made it to the Board? • Is there ongoing monitoring?

35. Course Map 1. Overview of ICAAP? 2. The ICAAP Process 3. Quantifying the PCR buffer 4. Document the process 5. Comprehensive review 6. Things to look out for

36. Importance of aligning ICAAP with PAIRS • APRA has not mandated an ICAAP format, however they have indicated that the more closely an ADI’s ICAAP aligns with both PAIRS and the Basel II risk categorisation and capital measurement framework, the less additional information gathering, investigation and analysis APRA needs to undertake. • Also: • Helps create a common language • Assists ADIs in understanding how APRA assessed them

37. ICAAP Implementation Plan • Where are you now • On the right track? • How much more to do? • Develop ICAAP policy and procedures • Carry out risk and control identification and assessment • Carry out integrated capital planning • Determine methodology for calculating uplift factor • Educate relevant management and Board • Build ICAAP into ongoing risk management • Produce an annual ICAAP document

38. Thank You ICAAP Internal Capital Adequacy Process David Bergmark Protecht Advisory david.bergmark@protecht.net