Reading the Tea Leaves of Recent Regulatory Guidance

December 2015 was a busy month for regulatory agencies and global standard setters. Throughout 2015, the industry had been waiting for additional guidance on high-impact topics including capital planning and allowance methodologies, and in the final stretch of the year, both the Federal Reserve and the Basel Committee on Banking Supervision (BCBS) complied. This paper will primarily focus on common themes in these two releases:

1. The Federal Reserve's "Guidance on Supervisory Assessment of Capital Planning and Positions" (SR 15-18 and SR 15-19)
2. The BCBS's "Guidance on Credit Risk and Accounting for Expected Credit Losses"

Recent guidance across a range of jurisdictions builds on previously voiced recognition that technology systems at many banks need improvement. Technology infrastructure has been stifled by legacy mergers and acquisitions that led to tactical system integrations, and by patched solutions to address immediate regulatory requirements. We observe that in recent regulatory guidance and proposals, there are themes that will compel financial institutions to take another critical view of their information systems. Additionally, these publications confirm that scenario-driven analysis is spreading from stress testing to business-as-usual risk management, including allowance processes. While much of the recent guidance will require interpretation over the coming months, we review the common themes, summarized in Figure 1, and their interconnectedness across organizational silos of the finance and risk functions.

A common thread consistently emphasized by the regulators is for financial institutions to improve risk identification and measurement at the enterprise level. The traditional delineation of responsibilities between chief financial officers and chief risk officers has led to a segregation of duties that has greatly enhanced risk management practices at large firms. However, the changes have also contributed to fragmented risk reporting that in turn obfuscates the "top of the house" view of a firm's risk profile.

Managing the complexity of data and models across business lines and developing a comprehensive strategy that is aligned with a firm's risk appetite is a challenging task. To maintain an effective process, management must focus on organizational planning, communication, and implementing robust information systems. As a result, a need for cross-organization coordination is imperative to identify and manage risk while maximizing efficiency. In this paper, we will address three key themes that are elements in achieving these objectives.

Figure 1. Unification of Risk Management Infrastructure

Source: Moody's Analytics

When considering how to meet the spirit of the recent regulatory standards, viewing the various standards through the lens of an effective governance framework can help identify connection points within the landscape of the organization. This first theme is a natural place to begin, because governance is the glue that unequivocally binds together the components of a bank's enterprise risk management system.

In its 2009 report for the Financial Stability Board, the Senior Supervisors Group stated: "Supervisors believe that considerable work remains in the areas of governance, incentives, internal controls, and infrastructure."¹ In the subsequent years, supervisors have become more and more vocal about their expectations for governance. The recent Fed guidance notes that firms must have "integrated management information systems, effective reporting, and change control processes." This message can be directly linked with the concurrent Agency Information Collection Proposal² that stated "all respondents to the FR Y-14A/Q/M reports should meet the Federal Reserve's expectations for internal controls." The proposal was recently approved³ and requires Chief Financial Officers of LISCC⁴ firms to attest to the quality of FR Y-14A/ Q/M reporting "in order to encourage large firms to improve their systems for developing data necessary for the stress tests and CCAR." These latest releases can be viewed as an effort by the regulators to remediate lingering issues initially outlined in the wake of the financial crisis.

At many banks, internal audits of the stress testing processes have prompted management to take initial steps to trace data lineage for each FR Y-14A report line item. However, a significant challenge for banks to overcome is the array of decentralized systems (often dozens) that feed the capital planning process. The governance of the process is challenged by the multitude of handoffs required to complete risk management and regulatory reports. The ad hoc nature of these handoffs and the resulting loss of data granularity, often through reliance on Excel-based manual processes, create operational risk. Increased regulatory emphasis on the active role of internal audit is creating constant pressure for firms to enhance their information systems. The adopted changes to the FR Y-14A/Q/M reports create additional pressure to enhance information systems, albeit at a staggered schedule, as follows:

1. Beginning with FR Y-14 M/Q/A reports as of December 31, 2016, LISCC firms will attest to internal controls.
2. Beginning with monthly, quarterly, and semi-annual reports as of January 31, 2017, there will be an additional attestation to the accuracy of the reported data, conformance with FR Y-14 instructions, and agreement to report material weaknesses and any material errors.
3. Beginning December 31, 2017, LISCC firms will attest to the effectiveness of internal controls around the FR Y-14A/M/Q (as a replacement to attestation described under #1 above).

As a result of the new requirements, many firms will need to reduce the number of ad hoc manual processes, replacing them with automated solutions that serve as a foundation for a transparent and auditable capital planning process, credible stress testing results, and risk appetite framework quantification.

Concurrently, accounting standard-setters around the globe are in the process of adopting standards that aim to address the many documented failures of the incurred loss model by requiring forward-looking credit loss models. The global IFRS 9 standard was published in July 2014, and in the US, the Financial Accounting Standards Board's Current Expected Credit Loss (CECL) standard is expected to be released in June 2016. With a targeted implementation in 2018 for IFRS 9 and essentially 2020 for CECL, we are only beginning to see the impact these changes will have on processes and controls, and therefore information systems at banks.

The move to forward-looking measures to inform the allowance will push firms to better integrate allowance methodologies with stress testing processes. That said, initially, the greatest challenge for the banking industry will be interpretation of the standards. In December, the BCBS published Guidance on Credit Risk and Accounting for Expected Credit Losses (ECL) highlights that the ECL framework may lead to significant investment:

"While the implementation of ECL accounting frameworks may require an investment in both resources and system developments/upgrades, standard setters have given (or are expected to give) firms a considerable time period to transition to the updated accounting requirements. On that basis, the Committee has significantly heightened supervisory expectations that internationally active banks will have a high-quality implementation of an ECL accounting framework."

The implications are significant, and are summarized in Figure 2.

Today, many financial institutions employ different systems and processes across their accounting, capital planning, and credit risk management groups. This leads to different data hierarchies and levels of granularity. Ongoing work to interpret the IFRS 9 standard and eventual CECL standard will drive future systems requirements, but it is evident that in many instances current information systems will not suffice. There will be opportunities in some cases to leverage common data and models across an organization. Enhancing these linkages will improve governance, transparency, and efficiency for firms. However, many firms will not have the technology infrastructure to seamlessly implement efficient processes. While existing Basel and Stress Testing / Capital Planning infrastructures may serve as starting points, both will need enhancement to meet the new standards. Moving forward, governance expectations from regulators across the globe will guide firms to strengthen the symbiotic relationship between stress testing frameworks and business as usual risk management systems.

The use of external data and models is common practice for financial institutions of all sizes. Reasons to employ external data or third-party models include:

1. The cost efficiency of leveraging industry-tested solutions versus those developed in-house
2. The time savings of implementing an out-of-the-box or customized third-party tool
3. The supplementation of internally developed solutions that may have insufficient internal data for modeling due to portfolio changes or lack of internal historical data

Additionally, external data and models are often used as benchmarks to meet industry model risk management standards. However, bank supervisors' more rigorous model risk management expectations have raised the bar for implementing these solutions with stricter "fit for use" criteria.

In the "Assessment of Capital Planning and Positions" guidance, the Fed aimed to clarify how it tailors expectations for large and complex firms versus noncomplex firms (e.g., generally large regional banks with assets between $50 billion and $250 billion). Figure 3 is a summary of the differentiated standard as it relates to the use of external data and models. It highlights areas subject to interpretation. For example, noncomplex firms, through conversations with the three regulatory agencies, will need to ascertain the interplay between Principle 2 of the interagency guidance on stress testing that requires "multiple conceptually sound stress testing activities and approaches" and SR 15-19 that as a minimum expectation eliminates the mandate for benchmark model use.

Figure 3. Differentiated standards for external models and data

Source: Moody's Analytics

There are many open questions on the use of external data and models with respect to ECL-based allowance implementation, as well. BCBS guidance on ECL states that robust allowance frameworks will generally "consider the relevant internal and external factors, that may affect ECL estimates, such as...changes in industry, geographical, economic and political factors." Some types of models applicable under IFRS 9 and expected under CECL may require more granular historical data with longer time series than available internally (to establish relationship with macroeconomic variables). The introduction of forward-looking credit loss models will inevitably increase the volatility of allowance calculations under ECL. The increased complexity of the calculation, coupled with the volatility of a forward-looking measure will have a direct impact to earnings. Thus, the lack of recognition for the increased allowance in key capital ratios will likely drive firms to conduct additional sensitivity analysis around key assumptions and increase the use of benchmarks. At the same time, any use of external tools will be subject to both an external and internal audit assessment of "table tools."

In the wake of the financial crisis, risk managers have been inundated with questions from regulators about how their bank gauges uncertainty and how they incorporate uncertainty into their pro-forma estimates. However, until recently, regulators released very little public guidance on how banks should specifically address uncertainty and include "difficult to quantify" risks in their stress scenarios. The recent publications from the Fed and the BCBS continue to highlight uncertainty as a concern. Fortunately, the Fed has provided some details for minimum expectations on the topic (as it pertains to Capital Planning). While the new guidance leaves questions as to how to incorporate various difficult-to-quantify risks, there is a clear theme of using sensitivity and scenario analysis to provide perspective on the pro-forma results. Banks are expected to leverage scenario analysis and sensitivity analysis to broadly capture uncertainty in their estimates due to the inherent limitations embedded within a single deterministic stress scenario.

For capital planning, the Fed also outlined the need to address the uncertainty of model outputs through sensitivity analysis of key assumptions. These expectations span the entire capital planning process, and include identifying and sensitivity testing key assumptions in individual models, as well as collectively at the aggregated level to "inform senior management and the board of directors about potential uncertainty" associated with the firm's projections. This will require firms to ensure they have strong assumption management processes in place, and also an established, transparent and auditable process to "justify, document, and appropriately challenge" assumptions.

Scenario analysis has emerged as an effective forward-looking tool to manage risk. However, the time, effort, and technology needed to conduct a bottom-up assessment of many different scenarios is daunting. For allowance calculations, it appears that the BCBS and the IASB6 are expecting banks to run a multitude of scenarios to ensure that ECL calculations are sound. Additionally, to meet the Fed's expectations related to scenario design, banks will need to run more scenarios to "collectively address all material risks to which the firm is exposed over the course of an annual planning cycle." The Fed discusses the importance of utilizing multiple scenarios "to assess a broad range of risks, stressful conditions or events," and evaluating its impact on the capital position of the firm. New, efficient tools will need to be developed to address these expectations and ensure banks are capturing all material risks in their bottom-up stress scenario analysis. Options to consider include applying simulation-driven portfolio management tools for enterprise-level sensitivity analysis and developing less granular top-down stress scenario models that are based on the firm's more detailed bottom-up approaches.

Contrasting recent news articles with the recently published regulatory guidance suggests that while front offices buzz with excitement of fintech and blockchain, back offices of financial institutions continue to need significant infrastructure improvements. The libretto of how banks move from the current state to the end-state infrastructure that meets the "new normal" of regulatory expectations is still being written. That said, the themes have been framed and will define parameters for technology enhancements.

In 2016, banks will need to critically assess whether existing systems across risk and finance functions support compliance with the upcoming capital planning and accounting guidance. This assessment will need to include a multitude of facets, including data lineage capabilities, operational efficiency, linkage to business-as-usual processes, robust internal controls, and the ability to support a range of end users. Systems will need to be able to trace loss estimates back to their sources (including loss models and overlays), as well as incorporate critical "top of the house" capabilities, such as establishing the linkage between the firm's risk appetite statement and the risk profile of the current positions and the pro-forma estimates.

For many institutions, this will mean kicking off multi-year transformational projects that will shape the future of their organization. Understanding the key linkages between finance and risk will be important in developing information systems that can meet the needs of the many internal stakeholders. It may take years to fully realize the value of these changes. However, firms will have the opportunity for many "quick wins" that will lead to cost savings and better business decisions along the way, and that will ultimately lead to using their stress testing processes in a more efficient and strategic manner.