Foreign DTI Subsidiary IRB Self-Assessment Instructions

List of Exhibits and Figures

• Exhibit 1 - List of Schedules
• Exhibit 2 - Mapping Self-Assessment Approaches to IRB Asset Classes
• Exhibit 3 - General Overview
• Exhibit 4 - Criteria/Segmentation: Non-Retail
• Exhibit 5 - Criteria/Segmentation: Retail
• Exhibit 6 - Methodology Borrower/Facility: Non-Retail and Retail
• Exhibit 7 - Responsibility
• Exhibit 8 - Performance of RRS
• Exhibit 9 - Use of RRS
• Exhibit 10 - RRS Overrides
• Exhibit 11 - Mapping of Compliance vs. IRB Implementation Stages
• Exhibit 12 - Self-Assessment Scorecard
• Exhibit 13 - RRS Summary
• Exhibit 14 - Update Timeline
• Figure 1 - Self-Assessment Package
• Figure 2 - Foreign DTI Subsidiary RRS Scorecard Structure
• Figure 3 - Vendor Model Inventory Template

Abbreviations

• AIRB Advanced internal ratings-based approach
• DTI Deposit-taking institution
• EAD Exposure at default
• FDS Foreign deposit-taking institution subsidiary
• FIRB Foundation internal ratings-based approach
• IRB Internal ratings-based approach
• LGD Loss given default
• PD Probability of default
• QRE Qualifying revolving exposures
• RWA Risk weighted assets
• RRS Risk rating system
• SME Small and medium-sized entity

1. Introduction

1.1 Definition

This document supports the approval framework for Canadian subsidiaries^{Footnote 1} of foreign deposit-taking institutions (foreign DTI subsidiaries) described in OSFI’s Implementation Note, 2007/2008 Approval of IRB Approaches for Institutions. The Implementation Note outlines the key principles, requirements and steps for the approval of Internal Risk Rating Systems for the internal ratings-based (IRB) methodology and minimum regulatory capital calculation outlined in Chapter 5 of the OSFI’s Capital Adequacy Requirements (CAR) Guideline A-1. The approval of foreign DTI subsidiaries will be performed in line with the Basel Committee’s principles for cross-border implementation of the Basel II framework^{Footnote 2}.

As indicated in the above Implementation Note, OSFI initially developed self-assessment template(s) and accompanying instructions for Phase 2^{Footnote 3} of the approval process for domestic institutions applying for the AIRB approach. These documents have been modified and simplified for use by foreign DTI subsidiaries to reflect home-host considerations.

These Instructions describe the self-assessment process and elaborate on the contents of the Foreign DTI Subsidiary Risk Rating System Scorecard (Schedules 1-4) and the Foreign DTI Subsidiary Risk Rating System Summary (Schedule 7). Schedules 5 and 6 of the AIRB Self Assessment templates for domestic institutions are not relevant to foreign DTI subsidiaries and therefore are omitted from this package. Most of the key dates provided in the Instructions are for institutions with a December 31 year-end. Key dates for institutions with an October 31 year-end are generally two months prior to the December 31 year-end dates.

The terms “institution” and “foreign DTI subsidiary” are used interchangeably in these Instructions.

A comprehensive self-assessment process is necessary for successful implementation of IRB. If completed with accuracy and appropriateness, the self-assessment process can leverage the limited time that exists prior to implementation of IRB by providing an assessment and analysis that is structured and consistent across the applicant institutions.

It is expected that an institution using IRB will have a clearly defined and robust self-assessment process that is supported by a variety of documentation. The institution will be able to provide evidence of the self-assessment work performed by delivering a completed self-assessment package^{Footnote 4} and other supporting documents to OSFI (see Section 2 of this document for details).

The self-assessment package summarizes the self-assessment work performed by the institution and provides a “road map” to all self-assessment documents developed and used by the institution for IRB approval purposes. Upon request, all documents that the institution refers to in its self-assessment package should be made available to OSFI.

1.2 Scope

The self-assessment process must determine if the foreign DTI subsidiary has:

1. a clear understanding of the IRB minimum requirements;
2. appropriate measures/criteria of success for each IRB minimum requirement;
3. adequate remedial actions for each gap identified;
4. a regular and well-defined process for assessment of compliance with the IRB minimum requirements;
5. clearly defined and documented the role and scope of work performed by risk and/or business management (as applicable) and internal audit in respect of IRB implementation; and
6. clearly defined and documented the division of responsibilities between the parent institution and the foreign DTI subsidiary.

1.3 Self-Assessment Process

In line with CAR Guideline A-1, the self-assessment process requires that risk and/or business management (as applicable) and internal audit provide the necessary assurances that the institution is in compliance with the IRB minimum requirements by the implementation date of the new Basel framework (i.e., as at January 1, 2008 for institutions with a December 31 year-end). OSFI recognizes that some of the requirements around the scope of work for these parties are new and will take time to build during implementation of the new Basel framework. OSFI also recognizes the need to avoid performing redundant and uncoordinated approval and validation work to reduce the implementation burden on institutions and to conserve supervisory resources. To address these requirements, OSFI has developed a five-step self-assessment process for foreign DTI subsidiaries.

Step 1: Information Exchange with Home-Country Supervisors

OSFI will work with the applicable home country supervisor to discuss the respective roles and responsibilities of each supervisor in the IRB approval process for the foreign DTI subsidiary, and to coordinate the information gathering process, based on the requirements of OSFI’s Foreign DTI Subsidiary RRS Scorecard and RRS Summary, the control structure of the foreign DTI subsidiary, and the requirements of the home-country supervisor.

Step 2: Review of Information Received from Home-Country Supervisor

OSFI will review the guidance received from the home-country supervisor in respect of its local approval process and will confirm the appropriate next steps for the foreign DTI subsidiary.

Step 3: Initial Self-Assessment

OSFI expects that a foreign DTI subsidiary will complete an initial self-assessment using the Foreign DTI Subsidiary RRS Scorecard based on the outcome of Steps 1 and 2. The scale and scope of completion will depend on the outcome of the host-home process. A foreign DTI subsidiary may be required to complete a more detailed self-assessment where the subsidiary contributes significantly to the risk rating system development and/or where limited integration exists within the parent-banking group. However, these and other considerations will be explored in coordination with the home-country supervisor.

Step 4: Follow-Up with Institution

After reviewing the foreign DTI subsidiary’s submission, OSFI will provide feedback and will conduct reviews, as applicable, in coordination with the home-country supervisor, as part of the local IRB approval process.

Step 5: Final Self-Assessment

Prior to the implementation date of Basel II, the institution will be required to provide a final self-assessment that updates and finalizes prior self-assessments using the Foreign DTI Subsidiary RRS Scorecard.

2. Self-Assessment Package

A foreign DTI subsidiary will be required to submit its self-assessment (“the self-assessment package”), as part of OSFI’s IRB approval process. The institution will submit an initial self-assessment package by April 1, 2006^{Footnote 5} (based on an assessment date of December 31, 2005). The institution will then re-submit a final self-assessment package by December 31, 2007 (based on an assessment date of September 30, 2007)^{Footnote 6}. Please refer to Figure 1 for graphical presentation of the self-assessment package, below.

The supporting documents to the self-assessment package should demonstrate the scope, depth, and quality of the self-assessment work performed by the foreign DTI subsidiary. This self-assessment work should demonstrate that all material and relevant issues have been identified and that the institution has undertaken or is undertaking appropriate action to address them in a timely fashion.

OSFI recognizes that the implementation process is ongoing and that the self-assessment will change throughout the implementation and rollout of IRB. Consequently, OSFI expects institutions to update parts of their self-assessment package on a regular basis to facilitate the monitoring of IRB implementation. Please refer to Section 5 for further details on the update timeline.

Schedules have been provided to enhance the structure of the self-assessment templates. The schedules identify distinct sections of the templates, including sections of the Foreign DTI Subsidiary RRS Scorecard and RRS Summary. All schedules are listed below in Exhibit 1.

Exhibit 1. List of Schedules

2.1 Chief Risk Officer’s Letter and Other Submissions

As indicated in the Implementation Note, 2007/2008 Approval of IRB Approaches for Institutions, Phase 2 of the approval process is the stage for formal application and preparation for “meaningful” parallel reporting. To commence Phase 2, the institution will submit a cover letter from the Chief Risk Officer, addressed to OSFI by April 1, 2006, as part of the initial self-assessment package. The letter will include the following:

1. The status of the institution’s implementation efforts and level of adherence to the IRB minimum requirements, including those parts of implementation not yet finalized, by the Formal Application Date (i.e., April 1, 2006 for those institutions with a December 31^st year-end intending to implement IRB by fiscal year-end 2007);
2. Information on the nature of any and all representations made to the Audit and Risk Committees of the Board in respect of the IRB implementation and approval;
3. The credit risk approach to be adopted by the parent institution on a consolidated basis for reporting under the new Basel framework^{Footnote 7};
4. Any differences in Pillar I credit risk approaches between the parent institution and the foreign DTI subsidiary (if applicable); and
5. The high-level division of responsibilities between the parent institution and foreign DTI subsidiary, as they relate to implementation of the new Basel framework and the self-assessment process.

In addition to the letter, the institution should submit other self-assessment documents. A detailed description of these requirements is outlined in Sections 2.3 to 2.6.

OSFI recognizes that this self-assessment work will be a work-in-progress and will reflect host-home considerations. Consequently, OSFI expects a high-level description of all work performed to date by risk and/or business management (as applicable) in respect of the foreign DTI subsidiary’s adherence to the IRB minimum requirements. Where such work is performed and OSFI is required to perform local approval work in cooperation with the home-country supervisor, the results of the assessment must also be included in the form of assessment ratings within the self-assessment package.

The institution will need to re-submit a letter from the Chief Risk Officer to OSFI by December 31, 2007, providing an updated view on the level of adherence to the IRB minimum requirements and the nature of any and all representations made to the Audit and Risk Committees of the Board in respect of the IRB implementation and approval.

2.2 Chief Internal Auditor’s Letter and Other Submissions

As part of the initial self-assessment package, the institution will submit a letter to OSFI from the Chief Internal Auditor by May 30, 2006, providing an assessment, in the form of negative assurance, based on the following information:

1. The work conducted to that point in time, observations and other audit procedures, on the institution’s progress towards readiness to adhere to all the IRB minimum requirements;
2. A review of management’s self-assessment made as part of the formal application, including the self-assessment process developed and implemented by risk and/or business management (as applicable); and

In addition to the letter, the institution will submit the following information:

1. Details of internal audit’s plans for the foreign DTI subsidiary during the parallel reporting period in respect of IRB implementation;
2. A description of the work performed to-date by internal audit in respect of the parent and the foreign DTI subsidiary’s adherence to the IRB minimum requirements. Where internal audit work is performed, the internal auditor’s opinion must also be included as part of the approval package; and
3. The division of responsibilities between the parent institution and the foreign DTI subsidiary in respect of internal audit work.

The institution will re-submit a letter from the Chief Internal Auditor to OSFI by December 31, 2007 providing an updated view on internal audit work performed to date as it relates to all points described above. This letter will also give an updated assessment in the form of an opinion from internal audit based on the following assessments:

1. The effectiveness of the internal controls; and
2. Whether the controls are designed appropriately to ensure adherence to all applicable IRB minimum requirements.

2.3 Description of the Self-Assessment Process

The institution will provide a report describing its internal self-assessment process by April 1, 2006. Unless there is a material change to the internal self-assessment process, the institution is not required to re-submit such a report again (see Section 1.3). Although there is no prescribed format for this report, it will include the following summary-level information:

1. An outline of the institution’s self-assessment approach;
2. A listing of all key steps in the self-assessment process;
3. An explanation of how the institution arrived at its overall assessment of IRB compliance;

2.4 Description of Materiality, Extensions, Exemptions, and Waivers

The institution will submit descriptions of all exemptions^{Footnote 8}, extensions^{Footnote 9} and waivers^{Footnote 10} by April 1, 2006. This should include a description of the tracking process used to monitor them throughout the rollout of IRB. Unless there is a material change, the institution is not required to re-submit this information; however, if at any stage material changes have occurred, the institution should inform OSFI of the changes on a timely basis.

The IRB approval process recognizes the importance of materiality and provides various mechanisms to accommodate the phased rollout of IRB. To support this approach, the institution should provide a document with sufficient detail on the assumptions underpinning the self-assessment process, including materiality assumptions. As a part of this document, the institution should show its assessment of materiality for all IRB asset classes listed in Exhibit 2.

2.5 Foreign DTI Subsidiary RRS Scorecard

The Foreign DTI Subsidiary RRS Scorecard is a simplified version of OSFI’s AIRB Scorecard and was designed as a tool to assist the self-assessment process for IRB approval, where OSFI is a host-country supervisor. The structure of the scorecard is based on the structure of OSFI’s CAR Guideline, but it also attempts to integrate other aspects, including work effort around the implementation and self-assessment process. The various schedules of the Foreign DTI Subsidiary RRS Scorecard need to be updated at different times. Please refer to Section 5 on Update Timeline.

OSFI will use the self-assessment package for monitoring an institution’s progress throughout the implementation process and rollout of IRB in coordination with the home-country supervisor. OSFI recognizes that institutions will continue implementation efforts throughout the parallel reporting period and this will impact self-assessments over time. The Scorecard is to be updated on a regular basis to capture this dynamic process, to the extent that material changes are identified and OSFI needs to fulfill its role as host-country supervisor. Refer to Exhibit 14 for the update frequencies.

The IRB minimum requirements relate to several levels of analysis, such as the consolidated banking group, the IRB asset class, and the internal risk rating system. Consequently, different types of self-assessments will be required at each level.

Depending on the asset class, the institution may be required to use two approaches within the self-assessment process. The first approach is based on an assessment at the level of the RRS, whereas the second approach is based on an assessment at the level of the IRB asset class^{Footnote 11}. See Exhibit 2 for the illustration of approaches.

Exhibit 2. Mapping Self-Assessment Approaches to IRB Asset Classes

Exhibit 2 illustrates that the institution has to populate one scorecard per RRS for corporate (including corporate SME), sovereign, bank, retail mortgages, retail QRE, and other retail asset classes.

However, internal rating system designs may vary among institutions; therefore, some institutions will have one RRS per asset class, while others will have one RRS for several asset classes. In situations where one RRS covers several asset classes, OSFI will permit the institutions to complete one scorecard for all appropriate asset classes, with the exception of retail exposures where a scorecard must be completed for each IRB asset class.

Institutions should clearly identify any differences between asset classes that apply to the requirements identified in the RRS Scorecard, including composition of the underlying portfolio (see Schedule 2).

In the case of retail exposures, OSFI expects institutions to complete one scorecard for each IRB asset class. For example, if the institution has one RRS for all retail exposures, the institution should populate three scorecards, for retail mortgages, qualifying revolvers and other retail exposures, respectively. Please see Section 3 for a more detailed description of the RRS Scorecard and Figure 2 for the structure of the RRS Scorecard.

The Foreign DTI Subsidiary RRS Scorecard workbook contains four schedules as follows:

• Schedule 1 – FDS Scorecard Template Structure;
• Schedule 2 – FDS RRS - Portfolio Overview;
• Schedule 3 – FDS Self-Assessment Summary, and
• Schedule 4 – FDS Supporting Worksheets.

OSFI recognizes that IRB approval (and self-assessment) will be performed at a sub-consolidated basis. For instances where material and relevant differences arise in the application and operation of an RRS across multiple legal jurisdictions, the institution should identify these within the self-assessment, and explain how these differences were combined into the sub-consolidated RRS self-assessment of IRB compliance.

There are no separate scorecards explicitly designed for specialized lending^{Footnote 12}, purchased receivables, IRB equity, and IRB asset securitization. Institutions are encouraged to conduct a self-assessment against the relevant paragraphs of OSFI’s CAR Guideline A-1 to ensure that they meet the requirements of the new Basel framework; this self-assessment should be made available to OSFI upon request.

2.6 RRS Summary

The RRS Summary template is presented in Schedule 7. The purpose of Schedule 7 is to give an overview of all the RRSs used by the institution as well as all exemptions, extensions and waivers.

In addition, Schedule 7 requires an institution to indicate the amount and percentage of gross credit assets and the IRB credit risk-weighted assets covered by each RRS used by the institution.

3. Foreign DTI Subsidiary RRS Scorecard

3.1 General Overview

The purpose of the Foreign DTI Subsidiary RRS Scorecard is to create a framework for self-assessment and supervisory review purposes during the IRB approval process, which also reflects home-host considerations. All responses and assessments provided in the RRS Scorecard are specific to the RRS identified by the institution.

Different parts of the Foreign DTI Subsidiary RRS Scorecard are shaded in different colors to assist in the use of the scorecard. Risk and/or business management (as applicable) should complete all areas shaded in blue. Internal audit should complete the areas shaded in orange. Areas that are shaded in gray should not be completed.

OSFI expects risk and/or business management (as applicable) to be primarily responsible for populating the scorecard. As a part of their self-assessment, risk and/or business management will identify gaps and map them to projects initiated by the institution and will provide an assessment of compliance with the IRB minimum requirements as at the appropriate assessment date.

Risk and/or business management should have clear measures of success for every assessment, whether the institution meets the requirement or has an outstanding gap to close. In addition, risk and/or business management should assess the status of projects, where these are identified as necessary for gap closure.

OSFI expects internal audit to complete columns 12 and 13 of the supporting worksheets in Schedule 4 and assess the institution’s adherence to the IRB minimum requirements, as set out in paragraph 443 of the CAR Guideline A-1.

3.2 Front Page

On the front page, the institution will complete summary information relating to the risk rating system as follows: the DTI name, the business unit that uses the RRS, the name of the RRS, the name of the portfolio^{Footnote 13}, the IRB asset class that is covered by the RRS, and the date when the self-assessment was done. If desired, the institutions may indicate the dates when the different schedules or ratings were updated.

3.3 Schedule 1 – Foreign DTI Subsidiary RRS Scorecard Template Structure

Schedule 1 (FDS Subsidiary RRS Scorecard Template Structure) illustrates the organization of the overall scorecard workbook and its associated schedules. Schedule 1 shows the three distinct sections of the Foreign DTI Subsidiary RRS Scorecard: (1) Introduction & Overview, (2) Self-Assessment Summary, and (3) Supporting Worksheets. Please refer to Figure 2 for a graphical presentation of the RRS Scorecard structure.

The first section includes three worksheets: (1) Front Page, (2) Schedule 1 - FDS Scorecard Template Structure, and (3) Schedule 2 – FDS RRS Portfolio Overview.

The second section contains Schedule 3 – FDS Self-Assessment Summary, which is populated automatically from supporting schedules.

The third section contains Schedule 4, which includes eight supporting worksheets. There is one worksheet for each selected subsection of the IRB minimum requirements of the CAR Guideline A-1, including the following: (1) Overall Compliance, (2) RRS Design, (3) RRS Operations, (4) Corporate Governance, CRCU, & Internal Audit, (5) Use of RRS, (6) Risk Quantification, (7) Validation, and (8) Supervisory LGD & EAD Estimates (FIRB).

Foreign DTI subsidiaries must complete Schedule 2, while other supporting schedules will be completed, as required, based on the outcomes of the home-host process outlined in Section 1.3.

3.4 Schedule 2 – FDS Risk Rating System Portfolio Overview

Schedule 2 (FDS Risk Rating System Portfolio Overview) provides an overview of the RRS together with information on the portfolio to which the RRS applies. The institution is asked to provide information broken down by non-retail and retail exposures, and by parent banking group (or consolidated basis) and foreign DTI subsidiary (or sub-consolidated basis). Schedule 2 contains ten tables, as listed below:

1. Table 1.1. RRS Definition
2. Table 1.2. General Overview
3. Table 1.3. Criteria/Segmentation Borrower/Facility
4. Table 1.4. Methodology (Borrower/Facility)
5. Table 1.5. Responsibility
6. Table 1.6. Performance of RRS
7. Table 1.7. Use of RRS
8. Table 1.8. RRS Overrides
9. Table 1.9. Implementation
10. Table 1.10 Internal Audit

3.4.1 RRS Definition

In Table 1.1 (RRS Definition), the institution will provide the name and abbreviation used internally to describe the RRS and define the RRS that is to be self-assessed. Table 1.1 has a highlighted area (shaded in blue) where the institution can input its definition.

3.4.2 General Overview

In Table 1.2 (General Overview), the institution will provide general background information on the RRS. If the institution uses one RRS Scorecard for several asset classes, it should provide clear explanation of any differences between the asset classes, as it is required in Table 1.2. Also, the institution should provide totals and the breakdowns by asset class. A brief description outlining what is required for each field is provided below in Exhibit 3.

Exhibit 3. General Overview

3.4.3 Criteria/Segmentation Borrower/Facility

In Table 1.3 (Criteria/Segmentation Borrower/Facility), the institution will provide information on RRS criteria/segmentation by borrower and facility rating dimension (and by parent banking group and foreign DTI subsidiary). The table is divided into two sections: non-retail and retail. For each instance, the institution will populate the sections highlighted in blue. A brief description outlining what is required for each field (by rating dimension) for the non-retail asset classes is provided in Exhibit 4.

Exhibit 4. Criteria/Segmentation: Non-Retail

A brief description outlining what is required for each field in the retail asset class table is provided below in Exhibit 5. For each instance, the institution will populate the sections highlighted in blue.

Exhibit 5. Criteria/Segmentation: Retail

3.4.4 Methodology (Borrower/Facility)

In Table 1.4 (Methodology (Borrower/Facility)), the institution will provide information on its rating assignment methodology. Table 1.4 is divided into two sections: non-retail and retail. A brief description outlining what is required for each field in the non-retail and retail asset class table is provided in Exhibit 6. For each instance, the institution will populate the sections highlighted in blue.

Exhibit 6. Methodology Borrower/Facility: Non-Retail and Retail

3.4.5 Responsibility

In Table 1.5 (Responsibility), the institution will indicate the department and contact information for parties responsible for the areas listed in Exhibit 7. Also, the institution will identify relative responsibilities between the parent banking group and the foreign DTI subsidiary. For each instance, the institution will populate the sections highlighted in blue.

Exhibit 7. Responsibility

3.4.6 Performance of RRS

In Table 1.6 (Performance of RRS), the institution will comment on the performance of the RRS. A brief description outlining what is required for each field is provided in Exhibit 8. Also, the institution will identify relative responsibilities between the parent banking group and the foreign DTI subsidiary. For each instance, the institution will populate the sections highlighted in blue.

Exhibit 8. Performance of RRS

3.4.7 Use of RRS

In Table 1.7 (Use of RRS), the institution will comment on the use of the RRS. Also, the institution will identify relative responsibilities between the parent banking group and the foreign DTI subsidiary. A brief description outlining what is required for each field is provided in Exhibit 9. For each instance, the institution is asked to populate the sections highlighted in blue.

Exhibit 9. Use of RRS

3.4.8 RRS Overrides

In Table 1.8 (RRS Overrides), the institution will comment on the frequency and scope of RRS overrides. Also, the institution will identify relative responsibilities between the parent banking group and the foreign DTI subsidiary. A brief description outlining what is required for each field is provided in Exhibit 10. For each instance, the institution is asked to populate the sections highlighted in blue.

Exhibit 10. RRS Overrides

3.4.9 Implementation

In Table 1.9 (Implementation), the institution is asked to summarize the division of responsibilities between the parent banking group and foreign DTI subsidiary for each of the major approval areas in the IRB minimum requirements. This is an important consideration for OSFI follow-up and discussion with the applicable home-country supervisor. As a general principle, the location of responsibility will drive the level of self-assessment detail required (e.g., rating systems that are designed, operated and validated locally will typically be subject to more detailed self-assessments than rating systems that are designed, operated and validated globally).

3.4.10 Internal Audit

In Table 1.10 (Internal Audit), the institution is asked to summarize the division of responsibilities of the parent banking group and foreign DTI subsidiary, in terms of internal audit work.

3.5 Schedule 3 – FDS Self-Assessment Summary

Schedule 3 (FDS Self-Assessment Summary) has two summary tables that are populated automatically from the supporting worksheets contained within Schedule 4. The purpose of these tables is to provide a snapshot of the overall self-assessment against the IRB minimum requirements.

3.6 Schedule 4 – Supporting Worksheets

Schedule 4 (Supporting Worksheets) consists of eight sections (one per worksheet):

1. Overall Compliance;
2. RRS Design;
3. RRS Operation;
4. Corporate Governance, CRCU & Internal Audit;
5. Use of RRS;
6. Risk Quantification;
7. Validation
8. Supervisory LGD and EAD Estimates (FIRB).

Please refer to 3.6.3 for detailed descriptions.

3.6.1 Overview

Chapter 5 of OSFI’s CAR Guideline A-1 structures the IRB minimum requirements in terms of key approval areas, such as RRS design and operation. For each approval area, related CAR paragraphs have been listed for reference purposes and brief descriptions of each paragraph have been provided. The institution is asked to assess itself against these paragraphs.

3.6.2 Ratings and Audit Status

There are two ratings that should be used in the supporting worksheets: “Rating 2” and “Rating 3” (“Rating 1” is not applicable for foreign DTI subsidiaries). These ratings are to be completed by the risk and/or business management. Internal audit indicates audit status in column 12. A summary of the rating types is outlined below, viz.

3.6.2.1 Rating 2 – Project Completion Status

Rating 2 (column 10) indicates the degree of completion for projects/activities that have been undertaken to close any compliance gaps related to the IRB minimum requirements. This rating is to be completed by risk and/or business management (as applicable). The rating is to be updated three times a year, and the date of the latest rating assessment should be stated in Table 2.2 on the same spreadsheet.

Risk and/or business management should be prepared to provide supporting documentation upon request to support its assessment, as part of the supervisory review process. Supporting documentation could include such things as project status dashboards, as well as other internally produced project management reports. The institution indicates the rating by using a drop-down menu of one of the following:

1. Completed – Green
2. On schedule – Green
3. Somewhat behind schedule (reversible^{Footnote 14}) – Yellow
4. Significantly behind schedule (non-reversible) – Red
5. No work has been completed – Blue.

3.6.2.2 Rating 3 – Compliance Status

Rating 3 (column 11) indicates the institution’s assessment of its status and progress towards full implementation. This rating is to be completed by risk and/or business management (as applicable). The rating is to be updated whenever material changes occur or at least once a year, and the date of the latest rating assessment should be stated in Table 2.2 on the same spreadsheet.

The rating could also be used as a reference point by internal audit in its assessment of adherence to the IRB minimum requirements. The institution indicates the rating by using a drop-down menu of one of the following:

1. Full compliance – Green
2. Substantial compliance (validation/use) – Yellow
3. Partial compliance (implementation) – Yellow
4. Non-compliance – Red
5. No internal assessment/approval work has been completed – Blue.

Exhibit 11 (below) provides a rough guideline of mapping of Rating-type 3 (Compliance) vs. the possible stages of IRB implementation, viz.

Exhibit 11. Mapping of Compliance vs. IRB Implementation Stages

Exhibit 11. Mapping of Compliance vs. IRB Implementation Stages (Text Version)

	Gap Analysis/ Gap Identified	Design	Development	Testing	Initial Validation	Implementation	Ongoing Validation	Use
Full compliance – Green								X
Substantial compliance – (validation/ use) - Yellow							X	X
Partial compliance – (implementation) – Yellow						X	X
Non-compliance – Red		X	X	X	X	X
No internal assessment/ approval work has been performed - Blue

3.6.2.3 Audit Status

Audit status (column 12) should be completed by internal audit based on work performed as at the date of the self-assessment. The status is to be updated whenever material changes occur or at least once a year, and the date of the latest update should be stated in Table 2.1 on the same spreadsheet. The institution indicates audit status by using a drop-down menu of one of the following:

1. Audit work completed,
2. Audit work in progress,
3. Audit work planned,
4. No audit work planned.

The institution will indicate Audit Date, performed and/or planned, in column 13. If the institution has done or plans to do several audits in the same area, dates of all audit work should be captured.

3.6.3 Structure of Supporting Worksheets

As indicated earlier, Schedule 4 (Supporting Worksheets) consists of eight supporting worksheets, one for each selected subsection of the key IRB minimum requirements of the CAR Guideline A-1:

1. Overall Compliance,
2. RRS Design,
3. RRS Operations,
4. Corporate Governance, CRCU, & Internal Audit,
5. Use of RRS,
6. Risk Quantification,
7. Validation, and
8. Supervisory LGD and EAD Estimates (FIRB).

The structure of each supporting worksheet is similar. Each worksheet is divided into three tables as follows: (1) Self-Assessment Scorecard, (2) Description of Assessment Work Completed (two parts), and (3) Names of all Supporting Documents.

3.6.3.1 Self-Assessment Scorecard

Table 1 (Self-Assessment Scorecard), has 13 columns. It contains sections that should be completed by risk and/or business management (as applicable) and sections that should be completed by internal audit. A detailed summary of what is required for each column is listed in Exhibit 12.

Exhibit 12. Self-Assessment Scorecard

3.6.3.2 Description of Assessment Work Completed

In Table 2.1 (Internal Audit), the institution will provide a brief description of all work completed by internal audit as at the self-assessment date. This description should include any reviews or activities.

In Table 2.2 (Other), the institution will describe the work done and rationale for assigning the rating status for current projects (column 10) and the rating status for compliance with IRB minimum requirements (column 11). The institution should also indicate when the assessment was done for each rating type. For more information on the update frequency of the various columns, please refer to Section 5 on Update Timeline.

In Table 2.2 (Other), the institution should also record any material changes to columns 6, 7, 8 and 9. In essence, this table can be used as a change log.

3.6.3.3 Names of Supporting Documents

In Table 3 (Names of Supporting Documents), the institution is asked to list all relevant supporting documents, such as guidelines, policies, project plans, internal audit reviews, review reports, or other applicable documents. The institution should also indicate relevant title(s), section(s), paragraph(s), etc. of the supporting documents for quick reference.

4. Schedule 7 – FDS RRS Summary

Note: Schedules 5 & 6 are not applicable for foreign DTI subsidiaries and therefore are not included in the package.

Schedule 7 (the FDS RRS Summary) provides an overview of all RRSs used by an institution (at a sub-consolidated level) as well as all exemptions, extensions and waivers. This is a summary table that integrates information from all IRB Scorecards and gives a snapshot of distribution of credit assets by RRS. On the front page, there is summary information, such as the institution name and the date on which the self-assessment was performed.

The template provides space for three RRSs. If the institution uses more than three RRSs, then additional rows should be pasted into the table, as applicable. The template provides additional rows for waivers, extensions and exemptions. Refer to Section 2.4 for the definitions.

The institution will provide information on total amounts of gross credit assets and total IRB credit risk-weighted assets covered by all RRSs in Columns 9, 10, 11, and 12 (at a sub-consolidated level). If the institution adds additional rows, it should ensure that the total sums all assets listed under the various RRSs, waivers, extensions and exemptions.

The RRS Summary table has 12 columns. A description outlining the required fields is given in Exhibit 13, below.

Exhibit 13. RRS Summary

5. Update Timeline

OSFI recognizes that the approval process is dynamic and that many activities will occur after the Formal Application Date (i.e., April 1, 2006). Consequently, the institution’s self-assessment package will also need to be dynamic to better reflect the current status of the institution’s implementation efforts.

To streamline the process and to identify critical areas for monitoring and updating, institutions will be required to re-submit their self-assessment by December 31, 2007 (based on an assessment date of September 30, 2007). In the interim, only Rating 2 should be updated on a regular basis. All other material changes should be reported on an exception basis to OSFI, as part of its regular monitoring process. Refer to Exhibit 14 for details.

Exhibit 14. Update Timeline

Appendix I: Five Phases of Approval Process

Appendix II: Key Milestones of Approval Process