Abstract
The financial crisis and resulting failure of large banks worldwide has shaken the entire world. Improper management of operational risk has been touted as one of the reasons for this failure. In light of the rising importance of operational risk management (ORM) in banks, the study explores the range of ORM practices followed by a cross section of Indian banks and compares them with the banks worldwide. The study also analyses the impact of size and ownership of banks on these practices. Reliability analysis using Cronbach alpha model, Kaiser–Meyer–Olkin (KMO) measure of sampling adequacy and Bartlett’s test of sphericity was used to test reliability of questionnaire and justifies the use of factor analysis. Factor analysis was performed to extract the most important variables in ORM. The small size of bank was observed to be a deterrent to deep involvement of operational risk functionaries, collection and usage of external loss data and data collection and analysis. Further, the performance/preparedness of public sector and old private sector banks lagged behind peers in usage of key reporting components, such as risk and control self-assessment (RCSA), key risk indicators (KRI), scenarios, collection and usage of external loss data, data collection and analysis and quantification and modelling of operational risk.
Keywords
Introduction
Over the last decade, operational risk has become a hard to ignore issue for financial analysts. The credit crisis of 2008 proved that improperly managed operational risks can lead to failure of financial organizations across the globe. It is further observed that all the underlying reasons for financial meltdown, namely, greed, complexity of banking and financial products, major advances in technology, increasing vulnerability of financial institutions, poor modelling, etc., have a striking resemblance with operational risk events. In light of this crisis, operational risk management (ORM) has become imperative for all the financial institutions. Indian banks were relatively protected from the sub-prime crisis and faced only an indirect impact of the liquidity crunch post the credit crisis. Strict lending criteria, no loans to sub-prime borrowers with combination of culture and regulations, cushioned them from crisis. However, it is essential to perform cross country analysis of ORM practices and track the performance of different banks following these practices (also termed as best practices!) worldwide. This would be helpful in charting out the best practices code for Indian banks when advanced management approach (AMA) compliance becomes mandatory. The Basel Committee on Banking Supervision (hereinafter BCBS) performed the Loss Data Collection Exercise 2008 which was published in 2009 (hereafter referred as BCBS 2009) to collect information on all four data elements used in advanced measurement approach, namely, internal loss data, external loss data, scenario analysis, and business environment and internal control factors (BEICFs). This study uses LDCE 2008 as a benchmark to compare the range of ORM practices followed by a cross section of 31 Indian banks of different categories and sizes.
Operational risk identification and measurement are still in evolutionary stage as compared to the maturity that market and credit risk measurements have achieved. There is a growing realization that, efficient ORM framework improves and reinforces the internal controls of the organization. Laker (2006) argues that greater complexity of banking activity and increasing dependence on technology and specialist skills has made operational risk as one of the most important risk facing banking institutions of which outsourcing and technology risk are two major sources of operational risk. Laviada (2007) emphasizes that internal audit should be alert to the whole process of implementation of the systems for managing operational risk in entities. Hughes (2009) observes that the 11 September 2001 terrorist attacks changed the debate around operational risk. It had an impact on firms’ operations, as well as economic and regulatory fallout; it raised questions about business continuity, financial crime and processing automation. Operational risk is not a new risk, but it is being increasingly realized by the bankers that many losses earlier described as credit or market risk were in fact due to failing operational or internal processes.
Review of Literature
Many empirical studies relate widely publicized loss events to the lack of ORM (Consiglio & Zenois, 2003; Giraud, 2005; Holmes, 2003). They insist that management of operational risk encourages better behaviour among firms. Wei (2006) and Cummins, Lewis and Wei (2006) examined that declines in market value due to announcement of operational loss events were of a larger magnitude than the operational losses causing them. They assert that the growth and survival of firms amidst intense competition depends upon the management and control of operational risks.
Management of operational risk still remains a challenge even for the global firms both due to the lack of ability to directly measure operational risk and also due to the complexity of the operational processes at many financial institutions. In the eighth global risk management survey performed by Deloitte (2012), it was noted that only 45 per cent of institutions rated themselves as extremely or very effective for managing operational risk, similar to the figure of 47 per cent in 2010. Operational risk management has been a continuing challenge.
Management of operational risk remains an enigma for the analysts and bankers alike. Various approaches have been suggested to manage operational risk in the past, and excessive reliance has been placed on different financial models. However, the models developed over the years failed to predict and prepare the firms for the catastrophe. It was further observed that frequency and severity of losses observed by AMA compliant banks with well-developed models were more as against non-AMA banks putting a question mark on relevance and effectiveness of AMA models. The reasons range from the banks being too large leading to relatively higher frequency and severity to failure of organizations in their ability to pick up early warning signals and actively manage them. This perpetuates the implementation of a holistic ORM programme focusing on both qualitative and quantitative information. Such a programme would require integration of risk self-assessment, control self-assessment, internal loss data, external loss data, vector autoregression (VAR) modelling, scenario analysis, audit issues, indicators, etc. into a common framework that supports managerial decision making.
Gupta (2011) argues against firms predominating ‘silo approach’ to risk management and shows that effective risk management can improve organizational performance but adequate infrastructure is not available in companies for implementing enterprise-wide risk management (EWRM). Kalyvas, Akkizidis, Zourka and Bouchereau (2006) argue that the AMA measurement system must take into account internal data, external data, scenario analysis, and internal controls and business environment factors. Haubenstock and Hardin (2003) suggested inclusion of scenario development for stress testing and incorporating scorecards and risk indicators.
Reynolds and Syer (2003) endorse the opinion of Kuehn and Neu (2003) and mention the internal modelling approach (IMA), loss distribution approach (LDA) and scorecard approach (SCA) as separate approaches but not the scenario-based analysis (SBA). A contrary view expressed by Fujii (2005) emphasizes that scenario-based AMA provides solutions to some of the problems (of the LDA). Chapelle, Crama, Hubner and Peters (2004) argue that while the AMA could encompass any proprietary model, the most popular AMA methodology is by far the LDA.
Additionally what we gather as key decision indicators in credit crunch by the banks and financial intermediaries across the world vide the study by Chowdhury (2011) published in Global Business Review, we infer that the SME sector is assigned lower risk weights in Basel II due to less sensitivity to systemic risk. The risk of default is of an idiosyncratic nature.
Operational risk models encompass a variety of statistical and econometric models designed to measure the regulatory and economic capital to be held against operational risk, and also models designed to study its causes and consequences. Peccia (2003) argues that modelling operational risk has become important because the environment in which banks operate has changed dramatically. Rao and Dev (2006) argue that the AMA is as much about managing operational risk as of measuring and calculating regulatory capital. Bolton and Berkey (2005) appreciate the ‘Sound Practices paper’ for providing an excellent outline for designing an ORM framework that can provide tangible benefits and does not get distracted by the challenges of operational risk modelling.
Basel II defined the use of internal data, external data, scenario analysis and BEICFs as elements of estimation of operational risk under AMA. Out of the above methods, Scenario Analysis and BEICFs (which include the use of risk and control self-assessment [RCSA], key risk indicators [KRIs] and SCA) have been classified as qualitative methods used to achieve AMA compliance. Haubenstock (2003) believes that KRIs are most useful when the volume of transactions is high. Iyer (2006) clarifies that, ‘KRI is not a measure of risk, it is an indicator of riskiness.’ Dev (2007) appreciates the rising popularity of RCSA as an ORM tool. He observes that RCSA is increasingly being used as a means of more fully assessing the effectiveness of the risk management framework of a bank from an operational risk perspective. Chapelle et al. (2004) review the rules of Basel II regarding the treatment of operational risk and focused on four axes of ORM, namely, incident reporting, dashboards, key performance indicators (KPIs), KRIs and RCSA.
A review of principles for sound management of operational risk performed by BCBS (2007) observes that failure to fully implement appropriate operational risk identification and management practices may result in direct and material financial losses, or reputational and consequential losses, as well as systemic impacts on other banks, customers, counterparties and the financial system. The review identified four principles as among the least thoroughly implemented by banks, namely, (i) operational risk identification and assessment, (ii) change management, (iii) operational risk appetite and tolerance and (iv) disclosure.
It is observed that none of these studies attempts to analyze ORM practices followed by banks in India. The studies have been limited to developed countries and even the study by BCBS covers only limited banks in India. The present study critically analyzes various ORM approaches followed by banks in India and compares them with those adopted worldwide. On the basis of this analysis, the study attempts to suggest an appropriate strategy for the Indian banks.
Objectives of the Study
The key objectives of this study are to explore the range of ORM practices followed by Indian banks and compare with practices of different banks worldwide. Further, the article would perform a cross comparison of range of ORM practices for advanced approaches to ORM in various categories (and sizes) of banks, that is, public sector, private sector (old), private sector (new) and foreign banks in India. The study would also explore key factors essential in the management of operational risk in Indian banks.
Methodology
Loss Data Collection Exercise 2008 performed by BCBS provides an evidence of the growth of banks worldwide in the field of modelling and management of operational risk. Research points out that banks from India and Brazil lag far behind their counterparts from the USA, UK, Japan and Australia in all respects of ORM right from methods of data collection to the analysis of data and development of appropriate models using the same. Many banks in these countries have already received AMA accreditation reflecting their advancement in the field of ORM.
In light of these facts, it is imperative to explore the present state of practices in ORM in Indian banks and find out the banks far behind their peers in ORM and hence more exposed to the risk. The present article explores the limiting criteria for banks (size or category) with less developed ORM system. This would bring to light the various shortcomings of ORM methodology of Indian banks and help in overcoming them.
The data used for the study are both primary and secondary, namely, questionnaire collected from risk practitioners (Chief Risk Officers/official in the ORM department/risk management department) in a cross section of 31 banks and the response of 121 banks worldwide collected by LDCE 2008. Basel II accord requires that AMA banks incorporate internal loss data, external loss data, scenario analysis and BEICFs into the modelling of operational risk capital. The questionnaire assesses the status of Indian banks in these four critical areas essential for achieving AMA.
Primary data contain information of fourteen public sector banks, five old private sector banks, seven new private sector banks and five foreign banks. The survey questionnaires were sent to these banks in the month of October 2009. The written/emailed responses to the questionnaires were received between November 2009 and February 2010. This was followed up by personal visits or phone calls in order to gain further insight into the implementation of ORM by these banks. The sample distribution is provided in Table 1.
Description of Sample Banks Assessed in the Survey
The 14 public sector banks constitute 45 per cent of the sample, 5 each private sector (old) and foreign banks represent 16 per cent each of the sample size. The sample includes all seven private sector banks (new) operating in India comprising 23 per cent of the sample. The banks were categorized as multinational company (MNC), large, average or small sized on the basis of assets. This will help explore a possible relationship between the size of the bank and various strategies and practices vis-à-vis operational risk. The responses to survey were divided into two sections, namely, (i) present status of ORM implementation and (ii) risk control and progress strategy.
The Reserve Bank of India has clearly articulated the approach for implementation of Basel II for commercial banks in India (RBI Notification 2007, 2009). As per Reserve Bank of India’s (RBI) guidelines, all commercial banks in India have begun Basel II compliance since March 2009 and adopted the Basic Indicator Approach (BIA) for operational risk. As of April 2010, all the banks in India follow the BIA approach for operational risk capital computation as against the trend in the USA, Europe, Japan and Australia. Of the 121 banks covered by LDCE 2008, 42 were AMA compliant, 51 followed the standardized approach (TSA) and 20 banks followed the BIA approach (8 non-AMA banks of the USA were not included as BIA and TSA were not available). As per the roadmap released by RBI (RBI Notification, 2009) on advanced approaches, Indian banks will not be able to introduce AMA before 31 March 2013.
Results
Results of the survey show that implementation of Basel II norms has definitely heightened awareness and importance being given to ORM by banks in India. However, when compared with the practices adopted by the banks all over the world (as per LDCE 2008), they still have a long road to travel. It was observed in the first section of the questionnaire that all 31 respondent banks displayed well-defined policy for ORM duly approved by their respective boards. Operational risk was being managed by a division of risk management department in most of the cases. All the respondent banks had an exclusive chief risk officer reflecting the sincerity of Indian banks towards risk management.
Involvement
Involvement of officials deep down to the branch level is essential for effective management of operational risk. If involvement of risk management officials is limited to the head office/corporate office, the impact of ORM strategies is compromised at the grassroots level. The LDCE 2008 considered deeper involvement essential for an effective ORM programme. The survey results reported wide variations in the involvement of operational risk functionaries at different banks in India. Multinational company’s size and large sized banks (including public sector, new private sector and foreign banks) implemented involvement way down to the zonal level and even at branch level by some respondents. However, the involvement was limited to the head office at small and average sized banks. Chi square test revealed significant relationship between the level of involvement and bank category (χ0.05; p = 0.042) and size of the bank (χ0.05; p = 0.000).
Reporting by Operational Risk Head
Reporting by operational risk head was observed to be more frequent at foreign banks (all; monthly) and the private sector (new) banks (43%; monthly) in contrast to public sector banks (quarterly). Frequent reporting ensures regular check of the framework and timely detection of errors. A significant relationship exists between bank category and frequency of reporting (χ0.05; p = 0.003).
Importance of Event Types
Basel II guidelines have listed out seven different event types categorized on the basis of historical experience of various operational risk-based loss events in the past. These events range from internal and external fraud to employment practices, damage to physical assets among others. Worldwide, the event types execution, delivery and process management (EDPM) and external fraud accounted for highest frequency of losses (Source: LDCE, 2008, Table 2) and highest annual loss amount was observed in clients, products and business practices (CPBP). Losses reported for business disruption and system failures and damage to physical assets were relatively lower.
Sum and Distribution of Annualized Frequencies by Business Line and Event Type
(ii) First row for each business line: sum of annualized loss frequencies.
(iii) Second row for each business line: distribution of losses across event types.
In contrast, the survey results indicate that most of the banks in India consider internal fraud to be most important operational risk event followed by external fraud (Table 3). These were followed by employment practices and workplace safety practices; clients, products and business practice; and business disruption and system failure. Indian banks should not ignore these factors as major losses have been observed in these event types as indicated by the LDCE 2008. Most of the respondents (74%, mainly public sector banks) were either neutral or did not consider the event Damage to Physical Assets (Natural Disaster, Terrorism) as important. A change in mindset is required here as recent past is testimony of India’s vulnerability to terrorism. A significant relationship was observed between importance of the event and different categories of banks (χ0.05; p = 0.0033).
Identification of Operational Risk Inherent in Material Activities
Identification of operational risk inherent in material activities helps in adopting appropriate precautionary measures to minimize instances of loss due to operational risk. All the borrowing, lending and treasury/funds management activities of banks are identified as material activities. Most of the respondents (58%) had initiated the process of identification of operational risk inherent in material activities but public sector banks (36%) and private sector (old) banks (20%) lagged behind their counterparts. The relationship between the category of bank and process of identification of operational risk inherent in material activities was significant (χ0.05; p = 0.001).
Ranking of Event Types by Different Category of Banks
Use of Internal Loss Data
The respondents were not comfortable in sharing loss data; hence, the responses were restricted to the practices in the internal loss data. A minimum of 3 years of internal loss data is required for developing the model for AMA. All the banks in India are collecting internal loss data with mild variation in the time period since when they have been doing this. Most of them (61%) have been collecting it for the past 3 years or more. The internal loss data have to be combined with external loss data to develop a good model for implementing AMA. However, absence of an agency to pool external loss data of banks in India till February 2009 has led to very few banks collecting the same. Most of them (45%) have started collecting external loss data in the past 1 year. Very few respondents have been collecting external loss data for more than a year, and all these were large public sector banks.
Use of BEICF Tools
BEICFs provide a forward-looking element to an AMA by considering business environment indicators (e.g., the rate of growth, employee turnover and new product introductions) and internal control factors (e.g., findings from the challenge process, internal audit results and system downtime). All AMA banks used BEICF tools for risk management and/or risk quantification (LDCE, 2008). The most commonly used BEICF tools were RCSAs (98%), audit results (90%) and KRIs/KPIs (81%). Use of the three major BEICF tools across the globe was similar, though KRIs/KPIs were used in only 43 per cent of Japanese AMA banks (Table 4). Nearly all the AMA banks used RCSAs (95%), audit results (88%) or KRIs/KPIs (81%) as tools to manage operational risk.
Use of BEICF Tools by AMA Banks as per LDCE 2008
An analysis of annual reports of Indian banks reflected that all the banks intending to move to AMA in future wanted to use RCSA. However, few respondents were using RCSA as an input for more than 3 years. The difference in usage of RCSA at present by different categories of banks was significant (χ0.05; p = 0.004).
Use of KRIs and KPIs is very popular worldwide. Some banks have more than 1,000 KPIs/KRIs which are used as an input in their operational risk measurement method. Among Indian banks, one-third of the respondents did not use KPIs/KRIs as an input. All the foreign banks, most of the private sector (new), old private sector banks (60%) and public sector banks (50%) used KPIs/KRIs as a key input. The difference in usage of KPIs/KRIs by different categories of banks was significant (χ0.05; p = 0.031). Indian banks must increase their usage of KRIs/KPIs to minimize potential operational risk losses and implement AMA in future.
Scenario Analysis
Scenario analysis is a popular input in the OR measurement methodology and is essential for implementing AMA. Worldwide, the banks with AMA accreditation have made extensive use of scenarios. Among respondent banks, one-third did not use scenarios as an input in their measurement methodology. All the foreign banks used scenario analysis (40% of them have been doing it for more than 3 years). The relationship between use of scenario analysis and category of bank was significant (χ0.05; p = 0.001).
Frequency of Updating of BEICF Tools
There is a wide range of practice in the frequency with which BEICF tools are updated in the AMA practising banks as per the BCBS survey. The RCSAs were updated generally either on an annual basis (43%), quarterly to semiannual basis (26%), or semiannually to annually (24%). The KRIs/KPIs were updated more frequently, typically from monthly to quarterly (52%). Audit results were updated to reflect the risk-based nature of the audit process, with a wide range of practice noted. Audit scores or findings were most often reviewed when triggered (26%), or updated more frequently on a monthly (19%), annual (19%), quarterly (14%) or semi-annual basis (17%). Regional variation was observed updating of BEICFs with AMA banks in Europe (85%) and Japan (71%) updating RCSAs less frequently than other regions (Table 5).
Updating of BEICF Tools: KRI/KPIs
Survey results indicate that most of the banks in India reviewed KRIs annually/biannually while others (39%) did not have any fixed review frequency. Most of the foreign banks and few private sector (old and new) banks reviewed their KRIs every 6 months. Relationship between bank ownership and frequency of KRI review was observed to be significant (χ0.05; p = 0.003).
Extreme Value Theory
Extreme value theory (EVT) is a quantitative modelling method suitable for operational risk since there are instances of extreme data points and heavy tail in operational risk. Once Indian banks prepare for the AMA accreditation, use of EVT will be inevitable. However, as of now, 68 per cent of the respondents did not use EVT in their measurement methodology while others have incorporated it in the past 1 year. The relationship between category of bank and use of EVT was significant (χ0.05; p = 0.046).
The second section of the questionnaire focused on risk control and progress strategy which included ranking of operational risk reporting components, frequency of KRI review and progress in quantification and modelling of operational risk.
Ranking of Operational Risk Reporting Components
Banks have the liberty of reporting quantum of operational risk using data from a variety of components, namely, internal loss data, external loss data, scenarios and BEICFs (RCSA and KRIs). However, this section of the study tried to identify the component considered most important by maximum respondents.
All respondents rated internal losses as most important operational risk reporting component followed by risk from new products. Inappropriate rating of highly sophisticated, structured and complex derivative products was the most prominent cause of the sub-prime crisis. Banks in India realize its importance, and hence, it was ranked most important by as many as 45 per cent of the respondents though some respondents (23%) did not feel it to be important since they do not launch a new product too often. Significant relationship was observed between new product risk rating and category of banks (χ0.05; p = 0.038).
Key risk indicators were considered most important/important operational risk reporting component by more than half of the respondents from all categories of banks in India. The banks in India have not yet realized the importance of including external loss data to model operational risk so only 11 per cent respondents rated external loss data as most important while 51 per cent rate it as important.
Many Indian banks mentioned in their annual reports that they would use RCSA for AMA modelling but the awareness about its importance has not percolated as yet. Only 16 per cent respondents rated it as most important while 55 per cent respondents rated RCSA as an important rating component and 40 per cent were neutral. Overall survey results indicate that Internal loss emerged as the most important reporting component followed by risks from new product and KRIs.
Data Collection Method (Internal and External Loss)
There are various methods for collection of internal loss data of which the best is the one which includes collection of both internal losses and near misses. More than half of the respondents (52%) used this method while others either collected losses over a floor value or all losses. All banks should be encouraged to maintain near miss database as well. Banks used newspaper clippings and market intelligence banks to build up external loss database besides subscribing to a loss database. Survey results indicated that only the respondents from MNC size and among the largest banks of country collected and scaled external loss data while a majority of them (52%) had not even started collecting any external loss data. A significant relationship was observed between collection method and size of the bank (χ0.05; p = 0.009) and category of bank (χ0.05; p = 0.004) implying small sized banks did not adopt latest external loss data collection methods.
Progress in Quantification and Modelling of Operational Risk
Basel Committee on Banking Supervision (2008) observes that one of the major distinguishing features of operational risk models is how the models combine internal loss data, external data, scenario analysis and BEICFs. As per RBI stipulations, Indian banks cannot apply for AMA before April 2013. However, the preparations for the same must begin at the earliest. Good progress has been made in this field only by 16 per cent respondents comprising mainly foreign banks and very few private sector bank (old) and (new) banks though 36 per cent respondents have started the process of modelling. Progress of public sector banks and private sector (old) lagged behind those of private sector (new) and foreign banks as most of the public sector banks (79%), and old private sector banks (60%) had not even begun the operational risk modelling process. A significant relationship between bank category and progress in quantification and modelling (χ0.05; p = 0.004) was observed.
The LDCE 2008 carried out by BCBS is clearly an evidence of the growth of banks worldwide in the field of modelling and management of ORM. The sample banks from India and Brazil lagged far behind their peers from the USA, UK, Japan and Australia. The difference was visible in all aspects with respect to operational risk ranging from methods of data collection to the analysis of data and development of appropriate models using the same. Many banks in these countries have already received AMA accreditation reflecting their advancement in ORM.
Total Variance Explained by Components of the First Section
Factor Analysis
The study performed factor analysis to decipher critical factors that distinguish the sample banks from each other so that banks are aware of selective factors which require more attention for developing a healthy ORM structure. The responses to survey were divided into two sections, namely, (i) present status of ORM implementation and (ii) risk control and progress strategy, for performing factor analysis separately on them. The first section analyzed the present status of ORM implementation among respondents and 15 variables were considered for factor analysis. The value of alpha in reliability analysis was 0.928; implying contents of the questionnaire are reliable. The value of Kaiser–Meyer–Olkin (KMO) measure of sampling adequacy (0.832) and significance value of Bartlett’s test (0.000) justified the use of factor analysis as a data reduction technique. Factor analysis reduced the set of 15 factors to 3 factors which together explained 72 per cent of variance (Table 6). Rotated component matrix revealed that the three factors important in differentiating present status of ORM implementation among Indian banks were: (i) Duration of usage of internal loss data, (ii) Methods of External Loss data collection and (iii) Usage of scorecards in operational risk measurement and management (Table 7).
Rotated Component Matrix for Factors Affecting Present Status of ORM Implementation
The second section compiled the risk control and progress strategy related practices The section observed and analyzed progress of respondents on a range of factors comprising ranking of various operational risk reporting components, frequency of updating them, progress in data collection and analysis and progress in quantification and modelling. The value of alpha in reliability analysis was 0.946, implying that the contents of the questionnaire were reliable. The value of KMO measure of sampling adequacy (0.691) and significance value of Bartlett’s test (0.000) justified usage of factor analysis as a data reduction technique.
Factor analysis reduced the set of 11 variables to 4 factors which together explained 74 per cent of variance (Table 8). Rotated component matrix revealed that the four factors important in risk control and reporting progress were: (i) ranking of external events as an operational risk reporting component (ii) ranking of RCSA as an operational risk reporting component (iii) ranking of new product risk as an operational risk reporting component and (iv) frequency of updating of KRIs/KPIs (Table 9).
Total Variance Explained by Components of the Second Section
Rotated Component Matrix for Factors Affecting Risk Control and Reporting Progress
Overall, the factor analysis led to the extraction of seven factors based upon variables with highest factor loadings under a particular factor in the rotated component matrix (three from the first section and four from the second section). Banks must endeavour to give maximum emphasis to these factors to minimize relative anomalies in their performance and preparation for advanced approaches to ORM. Further, this would create an overall operational risk aware culture among all the organizations.
Conclusion and Implications
The 3 billion fraud at Citibank, Gurgaon branch, in India at the hands of an employee is testimony that mere development of models cannot prevent internal frauds and hence losses due to operational risk. Emphasis must be rather placed on development of an overall risk aware culture for prevention of operational risk losses. The study of ORM practices of banks in India and other countries gives conclusive evidence of heightened awareness and due importance being given to operational risk. The practices followed evidence pragmatic mix of qualitative and quantitative aspects. The sub-prime crisis has made the organizations more conscious and as a result all new products are subject to risk review and sign-off process for identification and assessment of relevant risks. An advanced management approach is on the agenda of many banks, and they are gearing up for it by collecting relevant data. Although organizational structures continue to differ on their strategies and systems, there is a consistent trend of operational risk departments reporting under the purview of Chief Risk Officer. Size was observed to be a deterrent to deep involvement of operational risk functionaries, collection and usage of external loss data and data collection and analysis. Large sized banks had a well-developed framework/model for ORM/measurement as compared to their peers. Numerous areas emerged where the performance/preparedness of public sector and old private sector banks was observed to be lagging behind that of new private sector and foreign banks. Significant difference among different category of banks was observed in usage of key reporting components, such as RCSAs, KRIs, usage of scenarios, collection and usage of external loss data, data collection and analysis, quantification and modelling and updating of KRIs. All the banks are collecting the internal loss data. However, many Indian banks have not even started collecting external loss data. Though RCSA, scenario analysis, EVT and KPI/KRI are widely used as an input by Indian banks but the proportion of public sector banks and private sector (old) banks using them is lower. Significant progress in the field of quantification and modelling of operational risk was made by very few respondents.
It can further be recommended that public sector banks (especially small and average sized) and private sector banks (old) must gear up their progress towards implementation of operational risk policies, usage of RCSA and key risk indicators. Small and average sized banks can use the experience of their bigger counterparts in tiding over the hurdles in implementation of advanced approaches to capital calculation of operational risk. The Indian banks should learn lesson from sub-prime crisis that regular updating of self-assessment results, scenario analysis results and KRIs based on relevant reports is more important than the numbers themselves. Reserve Bank of India should consider giving relaxations to large banks in early adoption of AMA approach.
Footnotes
Acknowledgements
We are grateful to the anonymous referees of the journal for their extremely useful suggestions to improve the quality of the article. Usual disclaimers apply.