Risk Quantification at IRB Institutions

I. Introduction

OSFI’s Capital Adequacy Requirements (CAR) Guideline A-1 allows institutionsBanks and bank holding companies to which the Bank Act applies and federally regulated trust or loan companies to which the Trust and Loan Companies Act applies are collectively referred to as “institutions”.  to calculate capital for credit risk using an internal ratings-based (IRB) approach. Use of the IRB approach requires institutions to meet specific standards and to obtain the approval of their national supervisor. Chapter 5 of CAR provides standards for the quantification of key IRB estimates: probability of default (PD), loss given default (LGD) and exposure at default (EAD)Institutions using the Foundation IRB approach use Supervisory Estimates of LGD and EAD. .

This document elaborates on CAR and synthesizes principles for quantification of IRB estimates. The principles apply to all applications of the IRB method that require PD, LGD and EAD. Adherence to these principles will be an important consideration in OSFI’s initial approval of institutions for IRB and ongoing use of the IRB approach.

II. Background

Risk quantification is the process of assigning values to the three key risk parameters for IRB assessments of credit risk capital in IRB institutions: probability of default (PD), loss given default (LGD) and exposure at default (EAD). Discipline and judgement are required for successful application of the many methods available for risk quantification. Institutions will plan their quantification carefully, with attention to ratings philosophy, governance and data integrity, along with more technical issues of statistical inference, to ensure that the continuing commitment of resources is effective. Prompt and complete documentation is needed to give credence to the outputs of the rating system and to obtain regulatory approval.

Institutions may refer to CAR itself to see the specific standards applicable to IRB. However, these standards are subject to interpretation, and implementation by institutions is subject to OSFI approval. This document sets out principles that OSFI expects institutions to apply to risk quantification, with some discussion and general examples. They are given with the understanding that the application of these principles will be tempered with good judgment. This understanding does not negate the principles, but may restrain their application to avoid undue costs or perverse results. Institutions may encounter situations where the suggested procedures have negligible impact or do not make estimates more robust. In these cases, the institutions may consider other procedures. Documentation is essential for process review, validation, other aspects of good governance, and future risk quantification, but only to levels of detail that could plausibly be useful. Lists of what "might" be done are not exhaustive and are not meant to discourage institutions from proposing better approaches to risk quantification.

III. Principles

The methods that institutions use to estimate risk parameters will depend on their portfolio, information systems, expertise and history. However, all institutions need to establish an effective risk quantification framework that observes the principles outlined in this paper. OSFI will review adherence to these principles when deciding whether or not to approve the use of IRB methods to calculate regulatory capital.

1. Scope of Risk Quantification

Institutions should demonstrate that each parameter has been reasonably estimated. To do this, they should specify and document all aspects of risk quantification, including sample data, segmentation, estimation, application, and the role and scope of expert judgment.

Documentation for the risk quantification process should describe how all material and relevant aspects of risk quantification are implemented for each parameter. As part of an institution’s risk quantification process, institutions should consider new analytical techniques and evolving industry practices and adopt them if they improve the accuracy of estimates. All material changes to risk quantification should be immediately documented.

2. Data From Different Sources

Institutions will use data from different sources, including sources beyond their control. In risk quantification, institutions should understand the data they use and adjust them for their intended use.

To estimate the IRB parameters, an institution should use data from a population that represents the population to which the parameters will be applied. Not only should the obligors be similar, but characteristics and outcomes should also be defined consistently. If strict consistency is impossible, the institution should make suitable adjustments that, as much as possible, are based on empirical study.

Data from representative populations should be collected and adjusted for the purpose of estimation, which is to provide inputs to the capital formula that comply with the definitions and standards of CAR. Institutions should review the data they use, study how they were collected, and compare their characteristics to regulatory standards. The institution should look to CAR and other specific guidance for many of these standards, but a few deserve special attention here: definition of default, economic loss, rating philosophy, and the combination of data from different sources.

a) Definition of default

Many public studies of credit loss are based on a definition of default that varies from the definition used in CAR. Institutions’ own data developed for pricing and risk management may be based on a different definition. There may be good reasons for institutions to use various definitions in their internal systems. However, institutions are required to compare the estimates for IRB capital to estimates used elsewhere in the institution. Institutions are also required to use external data that is relevant to IRB estimation and to benchmark their results to external data. Institutions should therefore find ways to adjust estimates to a common definition of default. In order for statistics based on the IRB definition to be compared to other measures of default that are more or less inclusive, institutions’ information systems should flag different default events or horizons.

b) Economic loss

LGD is based on economic loss. Economic loss may be calculated using the exposure at the time of default, including principal, unpaid interest, and fees, and the present value of subsequent recoveries and related expenses discounted at a suitable rate. The institution should model and discount recoveries at a rate reflecting the uncertainty of recovery to arrive at economic, rather than accounting loss. Alternatively, the market value, net of expenses, at or near the time of default is a suitable value for recovery.

Institutions should trace or allocate recoveries and costs of recovery to specific defaulted facilities. Then, institutions should be able to trace or allocate recoveries to homogeneous pools with respect to LGD and to the correct time of default. The allocation of recovery costs may require judgment, but the process should be carefully designed to ensure that all true recovery costs are reasonably allocated. Institutions should test the effect of workout period assumptions on LGD parameters.

c) Rating philosophy

Macroeconomic factors cause credit losses to vary systemically over time. Therefore, institutions should model credit losses so that data collected over a term of years may be fairly compared to data from another term.

Institutions should pay attention to how exposures are classified under rating systems. Some rating systems focus on predicting next year's probability of default; as economic conditions change, ratings assigned to exposures may change dynamically in response. Other rating systems are designed to capture stress conditions and to group risks according to characteristics that are common through economic cycles. Migrations across ratings are infrequent and idiosyncratic; however, the default rate of each rating group changes with the economy. Often, institutions use hybrid rating systems. Institutions should understand the rating methodology behind data they use for parameter estimation and decide whether an adjustment is appropriate to improve quantification and to meet the requirements of CAR.

d) Combination of data

Sample data for risk quantification may come from various sources. For example, institutions often combine internal data with external data. When developing IRB standards, institutions should follow their internal standards for the combination of data from different sources to develop IRB estimates. The internal standards should address:

• consistency in definitions and rating philosophy;
• weighting data for statistical credibility;
• similarity of the underlying populations to the targeted portfolio;
• the need to extend the data used through economic cycles.

External data will pose special challenges for the application of this principle. However, the need to understand and make suitable adjustments is as important for external data as it is for internal.

3. Sufficiency of Data

Institutions should document their methods used to address the sufficiency of data in either the sample data or the existing portfolio. Here, professional judgment may play a decisive role, but institutions should ensure that the application of judgement does not result in parameters that provide an optimistic view of the future.

As much as possible, estimates should be based on relevant data, especially data from an institution’s own experience. However, for some portfolios there may be inadequate data. For these portfolios, estimates may be based on careful judgement; however, such judgment should not be biased toward low estimates of risk and reducing required capital. Instead, conservatism should be used to address the uncertainty. The institution should document the reasoning and any empirical support for the estimate, as well as the mechanics of the estimation.

Although this principle allows institutions to use the IRB method when institutions cannot provide at robust estimates from internal or external data, approval to use the IRB method will depend on an institution’s continued efforts to obtain accurate and relevant data.For further discussion, refer to OSFI’s Implementation Note, <a href="/node/390">Data Maintenance at IRB Institutions</a>.

4. Segmentation

Institutions should identify risk drivers to help classify exposures into homogenous groups. Institutions should justify their segmentation schemes, evaluating the advantages and disadvantages of using fewer or more risk drivers.

Institutions should identify risk driversHere, risk driver denotes a factor that helps classify risk. For example, loan to value would generally be considered a risk driver for PDs in the retail mortgage business because high loan to value is generally associated with high default rates.  for each risk parameter. In selecting which risk drivers to use, an institution should consider its own practices in the origination, acquisition and management of exposure, the practices of peer institutions (where available), and studies from industry associations and academics.

Institutions should use the most discriminating risk drivers to segmentSince these risk quantification principles are designed to be applicable to both retail and non-retail portfolios, segmentation could mean retail pools, wholesale rating grades or risk buckets.  portfolios into homogenous groupsOften called “pools” in retail banking and “grades” or “buckets” in wholesale banking. , i.e., groups that are similar with respect to PD, LGD or factors used to arrive at EADInstitutions may use a regression or other model of risk as a function of risk drivers to develop the IRB components, PD, EAD or LGD. Modeling an IRB component as a continuous function of a risk driver may be equivalent to segmentation. Either way, risk drivers explain performance, and changes in the prevalence of risk drivers will suitably change estimates of portfolio loss. . An institution should use a risk driver to segment risks if this improves estimates. Granular segments provide more valid estimates as the composition of a loan portfolio changes. However, finer segmentation also results in small groups of obligors. The observed default rates and loss severity for the small groups will be more volatile, adding uncertainty to risk estimates and validation. In designing their segmentation of risk, institutions should justify their choice of risk drivers and the structure of risk grades to which estimates of PD, LGD or EAD are assigned.

5. Long-run Estimation

Institutions should develop their estimates of PD, LGD and EAD from data collected over a sufficient term to meet the standards of CAR. Institutions should study their own experience over time with special attention to the response of their ratings assignment and risk estimates to macroeconomic conditions and changes in risk management.

Institutions should develop IRB parameters using long-term data and should model the behaviour of IRB parameters that result from their methodology through time. CAR specifies that institutions should have at least five to seven years of data to use the IRB method, but an average of five to seven years of data may not meet the requirements for a long-term average, and may not meet the requirements to include stress years. For EAD and LGD, institutions should not only incorporate data from stress years, but should also consider the correlation of LGD and EAD to default rates. (Refer to paragraphs 468 and 475 of CAR Guideline A-1.)

6. Uncertainty in Risk Quantification

Parameter estimates are intended to be predictive of future outcomes. Institutions should identify sources of uncertainty in risk quantification and document how they have addressed the uncertainty and the rationale for the same.

Institutions should estimate values of PD, LGD, and EAD as precisely and accurately as possible. However, such estimates are subject to uncertainty and, therefore, potential errors. In order to avoid over-optimism, an institution may need to adjust its estimates by adding a margin of conservatism. The extent of such adjustments should be related to factors such as the relevance and the quality of the sample data, the precision of the statistical estimates, and the amount and nature of judgment used throughout the process. For example, institutions could produce loss distribution curves and confidence intervals of estimates with different confidence levels.

Institutions should develop policy for the application of conservatism. For each estimate, they should also identify the sources of uncertainty, the range of uncertainty from each source, and the level of conservatism used. This tracking is necessary to assess the overall level of conservatism used, to verify that the level is adequate, and to modify conservatism suitably as new data becomes available.

To build a rational approach to conservatism, institutions should classify sources of error. Many classifications are possible, but there should be a sound connection between the classification and how the institution handles potential for error. Some types of uncertainty may be better handled at different levels of risk quantification than others. The application of conservatism at every step to cover a large portion of outcomes could lead to excessive conservatism overall. Therefore, the institution should focus on adequate margins for capital, rather than for each estimate.

In its classification of sources of error, an institution might address:

• sampling error resulting from a low number of obligors in the development dataset or a low number of obligors in the portfolio to which it is applied;
• uncertainty about a long-term average, because the institution cannot adequately sample the entire distribution of macroeconomic effects;
• uncertainty whether the dataset from which the institution develops an estimate truly represents the population to which the estimate is applied;
• uncertainty that may arise from suspicion that data has been selected or adjusted in ways inconsistent with the standards or intentions of CAR (e.g., arbitrary truncation of values to suit accounting conventions);
• uncertainties in the timing and amount of cash flows for LGD estimates, as well as the length of the workout term.

For each source of error, the institution should consider whether the overall degree of conservatism used by the institution is appropriate.

7. Response

Risk quantification should be a dynamic process that responds to internal and external events.

Institutions should have a consistent process to ensure that new data are incorporated into the PD, LGD and EAD estimates as they become available. The need to use fresh internal data is obvious as new business replaces old and long-term customers change. However, institutions should also set up processes to identify and incorporate relevant external data. They should consider changes in the competitive environment that might affect the risk characteristics of their own customers. Changes in the external environment, the institutions’ own practices and its mix of customers will affect the usefulness of some factors in predicting risk. Reviews of the external and internal environment should be regular and comprehensive. Estimates should be reviewed and updated when required and at least once a year. However, the institution should respond more rapidly to special events.

With respect to each homogeneous pool/grade of risks for IRB estimation, institutions should maintain logs of significant changes to institution practice and the external environment (as applicable) that could be expected to affect the behaviour of the pool or grade.

IV. Conclusion

Most of the principles for IRB risk quantification elaborated here imply the good practices that institutions should apply in their capital management and projections of loss. Some, such as the attention to macroeconomic factors and the incorporation of conservatism, are requirements of CAR that may not be in place for other purposes. All principles should be followed carefully to develop the risk parameters that drive capital under the IRB approach. In particular, institutions should recognize the uncertainties of their data and assumptions; any bias in their calculations should result in higher regulatory capital.