AIRB Self-Assessment Instructions

List of Exhibits and Figures

• Exhibit 1 - List of Schedules
• Exhibit 2 - Mapping Self-Assessment Approaches to IRB Asset Classes
• Exhibit 3 - General Overview
• Exhibit 4 - Criteria/Segmentation: Non-Retail
• Exhibit 5 - Criteria/Segmentation: Retail
• Exhibit 6 - Methodology Borrower/Facility: Non-Retail and Retail
• Exhibit 7 - Responsibility
• Exhibit 8 - Performance of RRS
• Exhibit 9 - Use of RRS
• Exhibit 10 - RRS Overrides
• Exhibit 11 - Significant Changes/Refreshments Since October, 2004
• Exhibit 12 - Mapping of Compliance vs. AIRB Implementation Stages
• Exhibit 13 - Self-Assessment Scorecard
• Exhibit 14 - Rating Grade Description for Internal Estimates
• Exhibit 15 - Developmental Evidence for Internal Estimates
• Exhibit 16 - Validation of Internal Estimates
• Exhibit 17 - Vendor Models: General Overview
• Exhibit 18 - Key Model Characteristics
• Exhibit 19 - Vendors
• Exhibit 20 - Future Development
• Exhibit 21 - RRS Summary
• Exhibit 22 - Update Timeline
• Figure 1 - Self-Assessment Package
• Figure 2 - AIRB RRS Scorecard Structure
• Figure 3 - Vendor Model Inventory Template

Abbreviations

• AIRB approach - Advanced internal ratings-based approach
• EAD - Exposure at default
• IRB approach - Internal ratings-based approach
• LGD - Loss given default
• PD - Probability of default
• QRE - Qualifying revolving exposures
• SME - Small and medium-sized entity
• RWA - Risk weighted assets
• RRS - Risk Rating System

1. Introduction

1.1 Definition

This document supports the approval framework described in the Implementation Note, 2007/2008 Approval of IRB Approaches for Institutions^{Footnote 1}, which outlines the key principles, requirements and steps for the approval of Internal Risk Rating Systems for the internal ratings-based (IRB) methodology and minimum regulatory capital calculation outlined in Chapter 5 of the OSFI’s Capital Adequacy Requirements (CAR) Guideline A-1. In its Implementation Note, OSFI indicated that self-assessment template(s) would be developed along with the instructions for Phase 2^{Footnote 2} of the approval process. Accordingly, OSFI has developed the following self-assessment documents:

1. AIRB Self-Assessment Instructions;
2. AIRB RRS Scorecard (Schedules 1-4);
3. Risk Parameters Mini-Scorecard (Schedule 5);
4. Vendor Model Inventory (Schedule 6); and
5. RRS Summary (Schedule 7).

These Instructions describe the self-assessment process and elaborate on the contents of the self-assessment templates, such as the AIRB RRS Scorecard and the Vendor Model Inventory, as well as other areas not explicitly provided for.

A comprehensive self-assessment process is necessary for successful implementation of AIRB. If completed with accuracy and appropriateness, the self-assessment process can leverage the limited time that exists prior to implementation of AIRB by providing an assessment and analysis that is structured and consistent across the applicant institutions.

It is expected that an institution using AIRB will have a clearly defined and robust self-assessment process that is supported by a variety of documentation. The institution will be able to provide evidence of the self-assessment work performed by delivering a self-assessment package^{Footnote 3} as well as other supporting documents to OSFI (see Section 2 of this document for details).

The self-assessment package summarizes the self-assessment work performed by the institution and provides a “road map” to all self-assessment documents developed and used by the institution for AIRB approval purposes. Upon request, all documents that the institution refers to in its self-assessment package should be made available to OSFI.

1.2 Scope

The self-assessment process must determine if the institution has:

1. a clear understanding of the AIRB minimum requirements;
2. appropriate measures/criteria of success for each AIRB minimum requirement;
3. adequate remedial actions for each gap identified;
4. a regular and well-defined process for assessment of compliance with the AIRB minimum requirements; and
5. clearly defined and documented the role and scope of work performed by risk and/or business management (as applicable) and internal audit in respect of AIRB implementation.

1.3 Initial and Final Self-Assessment

In line with CAR Guideline A-1, the self-assessment process requires that risk and/or business management (as applicable) and internal audit provide the necessary assurances that the institution is in compliance with the AIRB minimum requirements by the implementation date of the new Basel framework (i.e., as at November 1, 2007). OSFI recognizes that some of the requirements around the scope of work for these parties are new and will take time to build during implementation of the new Basel framework.

Consequently, OSFI expects that the initial assessment of adherence to the AIRB minimum requirements to be submitted by the Formal Application Date, i.e., February 1, 2006, based on a self-assessment as at October 31, 2005. The remaining work will be completed over the subsequent years of the AIRB rollout, particularly during the parallel reporting period.

The final self-assessment, including fully completed AIRB RRS Scorecard, should be submitted to OSFI by October 31, 2007, based on a self-assessment as at July 31, 2007 (see Section 7 of this document for details).

2. Self-Assessment Package

As part of OSFI’s AIRB approval process, the institution will submit the initial self-assessment package by February 1, 2006^{Footnote 4} and the final self-assessment package by October 31, 2007^{Footnote 5}. Please refer to Figure 1 for graphical presentation of the self-assessment package.

The supporting documents to the self-assessment package should demonstrate the scope, depth, and quality of the self-assessment work performed by the institution. This self-assessment work should demonstrate that all material and relevant issues have been identified and that the institution has undertaken or is undertaking appropriate action to address them in a timely fashion.

OSFI recognizes that the implementation process is ongoing and that the self-assessment will change throughout the implementation and rollout of AIRB. Consequently, OSFI expects the institutions to update parts of the self-assessment package on a regular basis to facilitate the monitoring of AIRB implementation. Please refer to Section 7 for further details on the update timeline.

Schedules have been provided to enhance the structure of the self-assessment templates. The schedules identify distinct sections of the templates, including sections of AIRB RRS Scorecard, Risk Parameters Mini-Scorecard, Vendor Model Inventory and RRS Summary. All schedules are listed below in Exhibit 1.

2.1 Chief Risk Officer’s Letter and Other Submissions

As indicated in the Implementation Note, Phase 2 of the approval process is the stage for formal application and preparation for “meaningful” parallel reporting. To commence Phase 2, the institution will need to submit a cover letter from the Chief Risk Officer, addressed to OSFI by February 1, 2006, as part of the initial self-assessment package. The letter will include the following:

1. The status of the institution’s implementation efforts and level of adherence to the AIRB minimum requirements, including those parts of implementation not yet finalized, by the Formal Application Date of AIRB (i.e., February 1, 2006 for those institutions intending to implement AIRB by fiscal year-end 2007); and
2. Information on the nature of any and all representations made to the Audit and Risk Committees of the board in respect of the AIRB implementation and approval.

In addition to the letter, the institution should submit its self-assessment package. Please refer to Sections 2.3 to 2.8 for a detailed description of this package.

OSFI recognizes that this self-assessment work will be a work-in-progress. Consequently, OSFI expects a description of all work performed to date by risk and/or business management (as applicable) in respect of the institution’s adherence to the AIRB minimum requirements. Where such work is performed, the results of the assessment must also be included in the form of assessment ratings within the self-assessment package.

The institution will need to re-submit a letter from the Chief Risk Officer to OSFI by October 31, 2007 providing an updated view on the level of adherence to the AIRB minimum requirements and the nature of any and all representations made to the Audit and Risk Committees of the Board in respect of the AIRB implementation and approval.

2.2 Chief Internal Auditor’s Letter and Other Submissions

As part of the initial self-assessment package, the institution will need to submit a letter from the Chief Internal Auditor addressed to OSFI by March 31, 2006, providing an assessment, in the form of negative assurance, based on the following information:

1. The work conducted to that point in time, observations and other audit procedures, on the institution’s progress towards readiness to adhere to all the AIRB minimum requirements; and
2. A review of management’s self-assessment made as part of the formal application, including the self-assessment process developed and implemented by the risk and/or business management (as applicable).

In addition to the letter, the institution will submit the following information:

1. A description of the work performed to-date by internal audit in respect of an institution’s adherence to the AIRB minimum requirements. Where internal audit work is performed, the internal auditor’s opinion must also be included as part of the approval package; and
2. Details of internal audit plans during the parallel reporting period in respect of AIRB implementation.

The institution will re-submit a letter from the Chief Internal Auditor to OSFI by October 31, 2007 providing an updated view on internal audit work performed to date as it relates to all points described above. This letter will also give an updated assessment in the form of an opinion from internal audit based on the following assessments:

1. The effectiveness of the internal controls; and
2. Whether the controls are designed appropriately to ensure adherence to all applicable IRB minimum requirements.

2.3 Description of the Self-Assessment Process

The institution will provide a report describing its internal self-assessment process by February 1, 2006. Unless there is a material change to the internal self-assessment process, the institution is not required to re-submit such a report again. Although there is no prescribed format for this report, it will include the following information:

1. An outline of the institution’s self-assessment approach;
2. A listing of all key steps in the self-assessment process;
3. An explanation of how the institution arrived at its overall assessment of AIRB compliance;
4. Information relating to those internal controls and/or tracking systems used respectively for monitoring design and development, implementation and validation, use testing, internal assessment, and approval;
5. A description of the governance process around the institution’s self-assessment, including a description of the roles and responsibilities of all key parties, such as the role of the Board (or a designated Committee thereof), senior management, risk and/or business management (as applicable), internal audit, and the Basel PMO;
6. The criteria, methods, and other means used to identify deficiencies and/or gaps in the institution’s self-assessment processes, policies, procedures and controls;
7. A clear description of guidelines around the sign-off process;
8. A summary of the institution’s approach to self-assessment against each approval area identified by OSFI’s Implementation Notes^{Footnote 6}; and
9. A list of the titles of all internal documents that were used for self-assessment purposes.

2.4 Description of Materiality, Extensions, Exemptions, and Waivers

The institution will submit the description of all exemptions, extensions and waivers by February 1, 2006. Unless there is a material change, the institution is not required to re-submit this information; however, if at any stage material changes have occurred, the institution should inform OSFI of the changes on a timely basis.

The IRB approval process recognizes the importance of materiality and provides various mechanisms to accommodate the phased rollout of AIRB. To support this approach, the institution should provide a document with sufficient detail on the assumptions underpinning the self-assessment process, including materiality assumptions. As a part of this document, the institution should show its assessment of materiality for all IRB asset classes listed in Exhibit 2.

In addition, as a part of the self-assessment process, all exemptions^{Footnote 7}, extensions^{Footnote 8} and waivers^{Footnote 9} should be listed, together with a description of the tracking process used to monitor them throughout the rollout of AIRB.

In order to minimize duplication with the rollout plan, this section should focus primarily on the self-assessment itself, and the management process and procedures supporting the self-assessment, as opposed to a description of exemptions and waivers themselves.

2.5 AIRB RRS Scorecard

The AIRB RRS Scorecard was designed as a tool to assist the self-assessment process for AIRB approval. The structure of the scorecard is based on the structure of the CAR Guideline, but it also attempts to integrate other aspects, including work effort around the implementation and self-assessment process. Various schedules of the AIRB RRS Scorecard need to be updated at different times. Please refer to Section 7 on Update Timeline.

OSFI will use the self-assessment package for monitoring an institution’s progress throughout the implementation process and rollout of AIRB. OSFI recognizes that institutions will continue implementation efforts throughout the parallel reporting period and this will impact self-assessments over time. The scorecard is to be updated on a regular basis to capture this dynamic process. Refer to Exhibit 22 for the update frequencies.

The AIRB minimum requirements relate to several levels of analysis such as the consolidated banking group, the IRB asset class, and the internal risk rating system. Consequently, different types of self-assessments will be required at each level.

The institution will be required to use two approaches within the self-assessment process. The first approach is based on an assessment at the level of the RRS, whereas the second approach is based on an assessment at the level of the IRB asset class^{Footnote 10}. See Exhibit 2 for the illustration of approaches.

Exhibit 2, above, illustrates that the institution has to populate one scorecard per RRS for corporate (including corporate SME), sovereign, bank, retail mortgages, QRE, and other retail asset classes.

Internal rating system designs vary among institutions; therefore, some institutions will have one RRS per asset class, while others will have one RRS for several asset classes. In situations where one RRS covers several asset classes, OSFI will permit the institutions to complete one scorecard for all appropriate asset classes with an exception of retail exposures.

Institutions should clearly identify any differences between asset classes that apply to the requirements identified in the RRS Scorecard, including composition of the underlying portfolio (see Schedule 2).

In the case of retail exposures, OSFI expects institutions to complete one scorecard for each IRB asset class. For example, if the institution has one RRS for all retail exposures, the institution should populate three scorecards, for retail mortgages, qualifying revolvers and other retail exposures, respectively. Please see Section 3 for a more detailed description of the RRS Scorecard and Figure 2 for the structure of the RRS Scorecard.

The AIRB RRS Scorecard workbook contains four schedules as follows:

• Schedule 1 – Scorecard Template Structure;
• Schedule 2 – RRS - Portfolio Overview;
• Schedule 3 – Self-Assessment Summary, and
• Schedule 4 – Supporting Worksheets.

OSFI recognizes that AIRB approval (and self-assessment) will be performed on a consolidated basis. However, for instances where material and relevant differences arise in the application and operation of an RRS across multiple legal jurisdictions, the institution should identify these within the self-assessment, and explain how these differences were combined into the consolidated RRS self-assessment of AIRB compliance.

There are no separate scorecards explicitly designed for specialized lending^{Footnote 11}, purchased receivables, IRB equity, and IRB asset securitization. Institutions are encouraged to conduct a self-assessment against the relevant paragraphs of the CAR Guideline A-1 to ensure that they meet the requirements of the new Basel framework; this self-assessment should be made available to OSFI upon request.

2.6 Risk Parameters Mini-Scorecard

The Risk Parameters Mini-Scorecard captures the RRS’s risk quantification details. It has only one table and is presented separately in Schedule 5.

The purpose of the Mini-Scorecard is to focus on the IRB parameters themselves, identifying supporting data and assumptions explicitly. Mini- Scorecards will be used for follow-up and review discussions on risk quantification and validation.

2.7 Vendor Model Inventory

The Vendor Model Inventory template is presented in Schedule 6. The workbook contains two sections: Section 1 – Vendor Non-Retail Model Inventory, and Section 2 – Vendor Retail Model Inventory.

Schedule 6 captures key information relating to external vendor models used by the institution^{Footnote 12} for non-retail and retail portfolios. Further detail on the Vendor Model Inventory is available in Section 5. Figure 3 shows the structure of the Vendor Model Inventory template.

2.8 RRS Summary

The RRS Summary template is presented in Schedule 7. The purpose of Schedule 7 is to give an overview of all RRSs used by the institution as well as all exemptions, extensions and waivers. In essence, this Schedule summarizes the key information from AIRB RRS Scorecard.

In addition, Schedule 7 asks the institutions to indicate the amount and percentage of gross credit assets and the IRB credit risk-weighted assets covered by each RRS. It also asks the institutions to compare the totals to QIS5 or BCAR and explain any differences.

3. Schedules 1 to 4 – AIRB RRS Scorecard

3.1 General Overview

The purpose of the AIRB RRS Scorecard is to create a framework for self-assessment and supervisory review purposes during the AIRB approval process. All responses and assessments provided in the RRS Scorecard are specific to the RRS identified by the institution.

Different parts of the AIRB RRS Scorecard are shaded in different colors to assist in the use of the scorecard. Risk and/or business management (as applicable) should complete all areas shaded in blue. By contrast, internal audit should complete the areas shaded in gray.

OSFI expects risk and/or business management (as applicable) to be primarily responsible for populating the scorecard. As a part of their self-assessment, risk and/or business management will identify gaps and map them to projects initiated by the institution and will provide an assessment of compliance with the AIRB minimum requirements as at the appropriate assessment date.

Risk and/or business management should have clear measures of success for every assessment, whether the institution meets the requirement or has an outstanding gap to close. In addition, risk and/or business management should assess the status of projects, where these are identified as necessary for gap closure.

OSFI expects internal audit to complete columns 12 and 13 of the supporting worksheets in Schedule 4 and assess the institution’s adherence to the AIRB minimum requirements, as set out in paragraph 443 of the CAR Guideline A-1.

3.2 Front Page

On the front page, the institution will complete summary information relating to the risk rating system as follows: the institution name, the business unit that uses the RRS, the name of the RRS, the name of the portfolio^{Footnote 13}, the IRB asset class that is covered by the RRS, and the date when the last self-assessment was done. If desired, the institutions may indicate the dates when the different schedules or ratings were updated.

3.3 Schedule 1 – AIRB RRS Scorecard Structure

Schedule 1 (AIRB RRS Scorecard Structure) illustrates the organization of the overall scorecard workbook and its associated schedules. Schedule 1 shows the three distinct sections of the AIRB RRS Scorecard: (1) Introduction & Overview, (2) Self-Assessment Summary, and (3) Supporting Schedules. Please refer to Figure 2 for a graphical presentation of the RRS Scorecard structure.

The first section includes three worksheets: (1) Front Page, (2) Schedule 1 - AIRB RRS Scorecard Template Structure, and (3) Schedule 2 - RRS Portfolio Overview.

The second section contains Schedule 3, which is a summary populated automatically from supporting schedules.

The third section contains Schedule 4, which includes seven supporting worksheets. There is one worksheet for each selected subsection of the IRB minimum requirements of the CAR Guideline A-1, including the following: (1) Overall Compliance, (2) RRS Design, (3) RRS Operations, (4) Corporate Governance, CRCU, & Internal Audit, (5) Use of RRS, (6) Risk Quantification, and (7) Validation.

3.4 Schedule 2 – RRS - Portfolio Overview

Schedule 2 (RRS – Portfolio Overview) provides an overview of the RRS together with information on the portfolio to which the RRS applies. The institution is asked to provide information broken down by retail and non-retail exposures as applicable. Schedule 2 contains nine tables as listed below:

1. Table 1.1. RRS Definition
2. Table 1.2. General Overview
3. Table 1.3. Criteria/Segmentation Borrower/Facility
4. Table 1.4. Methodology (Borrower/Facility)
5. Table 1.5. Responsibility
6. Table 1.6. Performance of RRS
7. Table 1.7. Use of RRS
8. Table 1.8. RRS Overrides
9. Table 1.9. Significant Changes/Refreshments since October, 2005.

3.4.1 RRS Definition

In Table 1.1 (RRS Definition), the institution will provide the name and abbreviation used internally to describe the RRS and define the RRS that is to be self-assessed. Table 1.1 has a highlighted area (shaded in blue) where the institution can input its definition.

3.4.2 General Overview

In Table 1.2 (General Overview), the institution will provide general background information on the RRS. If the institution uses one RRS Scorecard for several asset classes, it should provide clear explanation of any differences between the asset classes, as it is required in Table 1.2. Also, the institution should provide totals and the breakdowns by asset class. A brief description outlining what is required for each field is provided below in Exhibit 3.

3.4.3 Criteria/Segmentation Borrower/Facility

In Table 1.3 (Criteria/Segmentation Borrower/Facility), the institution will provide information on RRS criteria/segmentation by borrower and facility rating dimension. The table is divided into two sections: non-retail and retail. For each instance, the institution will populate the sections highlighted in blue. A brief description outlining what is required for each field (by rating dimension) for the non-retail asset classes is provided in Exhibit 4.

A brief description outlining what is required for each field in the retail asset class table is provided below in Exhibit 5. For each instance, the institution will populate the sections highlighted in blue.

3.4.4 Methodology (Borrower/Facility)

In Table 1.4 (Methodology (Borrower/Facility)), the institution will provide information on its rating assignment methodology. Table 1.4 is divided into two sections: non-retail and retail. A brief description outlining what is required for each field in the non-retail and retail asset class table is provided in Exhibit 6. For each instance, the institution will populate the sections highlighted in blue.

3.4.5 Responsibility

In Table 1.5 (Responsibility), the institution will indicate the department and contact information for parties responsible for the areas listed in Exhibit 7. For each instance, the institution will populate the sections highlighted in blue.

3.4.6 Performance of RRS

In Table 1.6 (Performance of RRS), the institution will comment on the performance of the RRS. A brief description outlining what is required for each field is provided in Exhibit 8. For each instance, the institution will populate the sections highlighted in blue.

3.4.7 Use of RRS

In Table 1.7 (Use of RRS), the institution will comment on the use of the RRS. A brief description outlining what is required for each field is provided in Exhibit 9. For each instance, the institution is asked to populate the sections highlighted in blue.

3.4.8 RRS Overrides

In Table 1.8 (RRS Overrides), the institution will comment on the frequency and scope of RRS overrides. A brief description outlining what is required for each field is provided in Exhibit 10. For each instance, the institution is asked to populate the sections highlighted in blue.

3.4.9 Significant Changes/Refreshments Since October, 2005

In Table 1.9 (Significant Changes/Refreshments Since October, 2005), the institution is asked to provide information on any significant changes and/or refreshments to the RRS that have occurred since October 31, 2005.

A brief description outlining what is required for each field is provided below in Exhibit 11. For each instance of change, the institution should populate the sections highlighted in blue. If more than five significant changes have been experienced, then the institution should copy and paste additional rows, as necessary.

3.5 Schedule 3 – Self-Assessment Summary

Schedule 3 (Self-Assessment Summary) has two summary tables that are populated automatically from the supporting worksheets. The purpose of these tables is to provide a snapshot of the overall self-assessment against the AIRB minimum requirements.

3.6 Schedule 4 – Supporting Worksheets

Schedule 4 (Supporting Worksheets) consists of seven sections (one per worksheet):

1. Overall Compliance;
2. RRS Design;
3. RRS Operation;
4. Corporate Governance, CRCU & Internal Audit;
5. Use of RRS;
6. Risk Quantification; and
7. Validation.

Please refer to 3.6.3 for details.

3.6.1 Overview

Chapter 5 of the CAR Guideline A-1 structures the AIRB minimum requirements in terms of key approval areas, such as RRS design and operation. For each approval area, related CAR paragraphs have been listed for reference purposes, and brief descriptions of each paragraph have been provided. The institution is asked to assess itself against these paragraphs.

3.6.2 Ratings and Audit Status

There are three rating types used in the supporting worksheets: Rating 1, Rating 2 and Rating 3. These ratings are to be completed by the risk and/or business management. Internal audit indicates audit status in column 12. A summary of the rating types is outlined below, viz.

3.6.2.1 Rating 1 – Gap Assessment

Rating 1 (column 5) is based on definitions used for gap analysis review purposes. This rating is to be completed by risk and/or business management (as applicable), and is to be updated at least once a year. The institution will indicate the date of gap assessment and its frequency in Table 2.2 on the same spreadsheet. The institution will select the rating by using a drop-down menu of one of the following:

1. Met (full compliance) – Green
2. Minor (insignificant implementation risk) – Yellow
3. Major (significant implementation risk)^{Footnote 14} – Red

3.6.2.2 Rating 2 – Project Completion Status

Rating 2 (column 10) indicates the degree of completion for projects/activities that have been undertaken to close any compliance gaps related to the AIRB minimum requirements. This rating is to be completed by risk and/or business management (as applicable). The rating is to be updated three times a year, and the date of the latest rating assessment should be stated in Table 2.2 on the same spreadsheet.

Risk and/or business management should be prepared to provide supporting documentation upon request to support its assessment, as part of the supervisory review process. Supporting documentation could include such things as project status dashboards, as well as other internally produced project management reports. The institution indicates the rating by using a drop-down menu of one of the following:

1. Completed – Green
2. On schedule – Green
3. Somewhat behind schedule (reversible^{Footnote 15}) – Yellow
4. Significantly behind schedule (non-reversible) – Red
5. No work has been completed – Blue.

3.6.2.3 Rating 3 – Compliance Status

Rating 3 (column 11) indicates the institution’s assessment of its status and progress towards full implementation. This rating is to be completed by risk and/or business management (as applicable). The rating is to be updated whenever material changes occur or at least once a year, and the date of the latest rating assessment should be stated in Table 2.2 on the same spreadsheet.

It could also be used as a reference point by internal audit in its assessment of adherence to the AIRB minimum requirements. The institution indicates the rating by using a drop-down menu of one of the following:

1. Full compliance – Green
2. Substantial compliance (validation/use) – Yellow
3. Partial compliance (implementation) – Yellow
4. Non-compliance – Red
5. No internal assessment/approval work has been completed – Blue.

Exhibit 12 (below) provides a rough guideline of mapping of Rating-type 3 (compliance) vs. the possible stages of AIRB implementation, viz.