Building a Stress Testing Framework to combine internal and - - PowerPoint PPT Presentation

Building a Stress Testing Framework to combine internal and regulatory stress tests to gain a full view of risks

12th November 2019

Information classification: Confidential

1

Disclaimer

This presentation has been prepared solely by the author and contains the thoughts and insights of the author.

2

Overview

ST Framework

• The framework fundamentals that must be in place to

undertake, approach and combine internal and external stress tests

• Regulatory considerations
• Board & senior management engagement

Full view of risks

• Risk inventory Stress test reconciliation
• Planning an all risks view for stakeholders
• Incorporating new risks in the Stress Testing plans
• Planning, risk Identification & Mitigation
• This presentation outlines 2 key aspects to building a framework to combine regulatory

and internal stress tests, to gain a full view of risks.

Information classification: Confidential

• 1. Framework Fundamentals

4

Information classification: Confidential

4 ASPECT Questions IMPORTANCE OF STRESS TESTING What is it and why is it important? USAGE/LINKAGE TO ENTERPRISE RISK & RISK APPETITE FRAMEWORKS The part that Stress Testing plays in identifying risks and Risk Appetite setting Usage includes capital adequacy assessment, strategic decision making etc RISK TYPES covered eg Capital adequacy risk (covering Credit , Market Operational, P/L etc) Liquidity risk Earnings volatility risk Strategic risk Regulatory risk SCOPE Regulatory stress tests (ICAAP/ILAAP/ RRP) Internal stress tests (Budget) Group-wide stress tests (ACS 2020, EBA 2020 etc) Legal entity stress tests ROLES & RESPONSIBILITIES & OPERATING MODEL How is the institution organised to undertake stress testing? Role of Board 3LoD Which functions are in each LoD? End to end Process Controls over Planning, Scenario setting, Execution, Governance and Reporting GOVERNANCE What are the governance arrangements in place to review, challenge and approve the ST results? RISK ASSESSMENT What is the process for assessing identified business/ portfolio/ regulatory etc risks for inclusion in the stress test? RELATED POLICIES What other policies should also be considered eg Model Risk policy, EUDA policy? APPROVAL Who approves the framework? The following lists out the basic building blocks that make up a Stress Testing Framework.

• 2. Regulatory Fundamentals

BIS Principles 2009

BIS Egs

• ST should form an integral part of the overall governance and risk management culture of the bank
• ST ensures promotion of risk identification & control
• Infrastructure should be robust but flexible to modify stress tests and levels of granularity

Regulatory principles/ standards eg EBA guidelines, local regulatory guidance

EBA Egs:

• ST covers all material risks and, in particular, allows the identification of emerging vulnerabilities that

could potentially be further assessed even in the same stress testing exercise

• Stress tests should take into account all types of material risk having regard to both the on- and off-

balance-sheet assets and liabilities of an institution

• Stress tests should capture risks at various levels in an institution.

BCBS guidance October 2018

• 9 overarching

principles (with c 100 sub principles)

BCBS

• Stress testing frameworks should have clearly articulated and formally adopted objectives
• Stress testing frameworks should include an effective governance structure
• Stress testing should be used as a risk management tool and to inform business decisions
• Stress testing frameworks should capture material and relevant risks and apply stresses that are

sufficiently severe

• Resources and organisational structures should be adequate to meet the objectives of the stress

testing framework

• Stress tests should be supported by accurate and sufficiently granular data and by robust IT systems
• Models and methodologies to assess the impacts of scenarios and sensitivities should be fit for

purpose

• Stress testing models, results and frameworks should be subject to challenge and regular review
• Stress testing practices and findings should be communicated within and across jurisdictions

5

Information classification: Confidential

• The Stress Testing function must regularly self assess adherence to regulatory guidelines and ensure it has plans in place to address

the identified shortfalls

• Note the emphasis on risk identification and risk management below

• 3. Board & senior management Fundamentals

Responsibilities Understanding of the Board’s (including NEDs) and senior management responsibilities regarding Stress Testing

• Obtain Board meeting Terms of Reference
• Understand who comes within remit of

Senior Manager regime and how their

• bjectives are set with respect to Stress

Testing

Board Approval Board approval of Stress testing Framework and Stress results

• Devise suitable Stress testing Education

briefings and ensure rolled out as appropriate

Annual Plan Preparation and presentation of the Annual Stress testing plan to Board and senior Execs

6

Information classification: Confidential

• The key to a successful integrated approach to stress testing is to ensure the Board and senior management are engaged and actively

sponsor/ buy in to the types of stress testing and risk coverage undertaken

Education Board/ NED and senior management education on stress testing

• Define stakeholder audience and

frequency of update

• Regulatory expectations of the Board’s

involvement and fulfilment of its responsibilities

• Articulated responsibilities

and objectives with respect to Stress testing

• Stress Testing plans

defined and communicated to appropriate audiences at agreed frequency

• Board Challenge/ Approval
• f the Stress Testing

framework/ major results

• Consistency of

understanding leading to fuller engagement

• Observed ability to fulfil

required roles and responsibilities eg degree

• f Board level debate

Outcomes Aspect Stress Testing function focus

• 4. Risk Inventory/ Stress Test Reconciliation

Risk Inventory Sub-risks ICAAP ILAAP REG STRESSES Other Follow-ups Credit …….. …….. ü Included ü etc Market etc Operational (inc Fraud) Conduct Pension Capital Adequacy Funding & Liquidity Regulatory Compliance AML Reputational Other Balance Sheet risks Eg Intangible assets Intra-group Etc Eg: Attention needed on …

Information classification: Confidential

• 5. Planning an all risks view/ insight to stakeholders

8

Information classification: Confidential

8

• An all risks view of stress testing is best served by identifying all activities/ stakeholders (both internal and external) and
• Bringing together regular insightful Consolidated MI/ Reporting incorporating answers to the ‘So what ?‘ question

‘Silo’ Activity Usage Benefits Stakeholders

Capital adequacy Sufficiency and efficiency of capital

• ICAAP Regulatory deliverables
• Focus on more/less capital intensive businesses
• Capital planning/ optimisation
• Board
• Regulators
• Businesses
• Treasury
• Ratings

Agencies/Investors Liquidity adequacy Short term survivability

• ILAAP Regulatory deliverables
• Focus on more/less liquidity intensive businesses
• Liquidity planning

Budget planning Testing credibility of the Strategic plan

• Credibility of target financial ratios
• Informs Dividend decisioning

Risk Appetite setting Credit, Earnings Volatility, portfolios and products

• Short term and medium term profitability and

business focus Acquisitions & Disposals Decisioning

• Alignment with strategy

Reverse Stress Testing Recovery & Resolution Planning

• Scenarios that break the business model/ bank and

extent of Management Actions to bring it back Lessons Learnt Self improvement on each exercise

• Better stakeholder added value on future exercises
• More transparent risk coverage
• Board
• Businesses
• Treasury

Forward looking risk radar All risks enterprise wide view

• Informs perspectives of ‘Whats over the hill and

around the corner?’ eg new risks/ new stress tests Consolidated dashboard Integrated Stress testing (internal) Reporting

• An easy to read risk radar to enable Board and

businesses to identify risks and make timely decisions

• 6. Incorporating new risks in the Stress Testing plans

Update Stress Test Annual plan (identifying risks covered) Plan & Run Stress Test xxx Analyse/Report results Board/ exec discussion

Provide insight in to risk management; Are all relevant identified Balance sheet and P/L risks suitably stressed?? Board and executive challenge of the results Processes 9

Identification of new risks Follow up actions/ issues Assess materiality

Identify risks covered in Stress test xxx. Execute Stress test. Consequences of the results/ follow up actions What risks did we not cover eg Intragroup? What new/ modified stress tests are required? What further insight does the Board need? Assess materiality of risks/ Undertake formal lessons learnt process and feed back into future stress test plans

Information classification: Confidential

Lessons Learnt

• 7. Using stress testing to inform planning, risk identification/mitigation

10

Information classification: Confidential

10

Usage

Risk identification Planning

Contingency Planning

Risk Mitigation

Trigger more detailed stress testing 10

• Set new capital / balance sheet constraints if adverse loss

scenarios are outside risk appetite Limit new business/ renewals

• Determine impact of specific stress and build contingency

plan

• Assess validity of existing contingency planning

Budgeting/ Capital management

• Forecast loan losses to feed into P/L budget with impact on

future business volumes/cost bases Risk Appetite assessment

• Assess risk exposures against risk appetite
• Identify high risk portfolios/ names to be investigated

further

• Identify names to be added to watchlist

Risk Appetite assessment

• Identify risk hotspots outside risk appetite/ Use to inform

macro hedges required Macro hedging/ portfolio disposal Single name hedging

• Identify name risks

Restructuring & recoveries

• Identify problem names/ portfolios earlier

Eg’s of pro-active follow up actions ST Exercise

• 8. Conclusion (1/2)

a) Certain framework fundamentals need to be in place first

• One Framework: There should be one overall stress testing framework rather than

several silo stress testing frameworks setting out the scope of stress testing exercises and the risks addressed

• Regulations: Principles based local and international regulations, focussing on the fit for

purposeness of the function should be self assessed, risks identified, gaps identified and addressed

• Board approval: Top of the house endorsement of the importance of stress testing by

approving the stress testing framework and major stress test results covering the full range of risks

• Business understanding: A robust education programme is needed for Board/ NEDs and

senior management covering Stress Testing (why it exists and the important part they play in it)

• Annual plan: A comprehensive stress testing annual plan needs to be produced covering

required risk types, ideally tabled at Board for annual approval

• Stress Testing results MI: needs to show how the balance sheet and hence P/L (balance

sheet risks and P/L risks) changes under stress rather than focussing purely on a target CET1 ratio or a Leverage ratio

In order to build and embed a stress testing framework that gives a full internal and external view of risks,

Information classification: Confidential

• 8. Conclusion (2/2)

In order to build and embed a stress testing framework that gives a full internal and external view of risks,

b) Focus on developing and embedding a full view of risk

• Material risks focus
• Newly emerging risks: need to be incorporated in the annual stress testing plan
• Risk Identification: The central stress testing team should reconcile their organisation’s

Risk Inventory to those risks covered in the scope of existing stress testing to assess whether other risks not currently covered should be covered

• Business buy-in: The Head of Stress testing should follow up that ST results drive

business decisions eg appetite setting/ acquisitions such that all identified new material risks are stressed prior to exec decisions

• Annual plan completeness of risk coverage: The Head of stress testing should

periodically survey internal stakeholders to confirm whether the Annual Stress testing programme risk coverage is effective

• Risk Reporting; A Consolidated dashboard should be considered to bring together silo

stress test activities to enable senior stakeholders to make timely and informed decisions on risks and answer the ‘so what question?’

Information classification: Confidential