. Methodology for the calculation of capital
The NBCA established the bases for undertaking a sound calculation of the capital
requirements for OR, defining three different approaches that vary depending on their
complexity and sophistication. The requirements, qualitative and quantitative, that
entities must comply with will be determined by the methodology chosen. Therefore,
internal auditors should be able to review and contribute to the validation of these
methodologies and what their application involves.
In this sense, the levels of knowledge required by the internal auditors will be
determined by the methodology adopted. So, in the case of the basic indicator
approach, the audit role will largely be limited to reviewing compliance with the
qualitative criteria, while in the case of the advanced measurement approach it may be
necessary to understand the statistical and mathematical techniques used, as well as
having a deep knowledge of the organization and of the financial sector in general.
Independently of the methodology chosen by the entity, the internal auditor will
verify that the different procedures created for managing OR comply with the
requirements of the capital methodology adopted.
Among the aspects for review, internal auditors should consider the following:
.
.
.
.
.
.
existence of a function responsible for determining the regulatory capital
requirement for OR;
degree of automation of the process and controls implemented;
existence of supervision processes that ensure the soundness of the calculations
made;
establishment of thresholds and alerts for cases where the thresholds are
breached;
establishment of a reporting flow that ensures that all-pertinent information is
presented to the senior management with the level of appropriate detail; and
adequate documentation of the information used to complete the calculation.
3.1 Basic indicator approach
Rather than focusing on the capital calculation, due to its simplicity, the internal
auditors must ensure that the selection of this option does not imply an inappropriate
level of OR management
3.2 Standardized approach
The internal auditors will confirm the existence of documented policies and criteria for
assigning gross income to the eight business lines and the soundness of the
calculations made. Some of these confirmations are likely to include:
.
.
.
.
.
.
.
Assignment of all the activities undertaken in the entity to one of the business lines
detailed in the New Capital Accord using objective criteria. This assignment will
be consistent with the methodologies used for the credit and market risk.
Existence of co-operation with those areas in charge of managing other
categories of risk (compliance, credit and market risk for example) to ensure a
unified approach to the management procedures and to the assignment of
activities to business lines.
Consideration of OR in the design, analysis and approval of new products or new
activities.
Review the gross incomes obtained in each one of the activities assigned to the
business lines.
Structure the accounting according to the business lines.
Adequate documentation of the approach to the assignment of operational losses
to the different business lines.
Adequate application of internal methods to fix prices, with documented formal
policies, approved by the senior management and taking into account the income
assigned to the business lines as well as the capital requirements.
3.3 Advanced measurement approaches
The complexity in the application of this type of methodology demands that entities
have undertaken an entire preparation process that sets the basis for the effective
execution of the requirements demanded by the regulators. If an entity decides to use
an advanced approach, it is important for the Internal Audit function to participate in
the process of checking and analyzing, among other, the following aspects:
.
.
.
.
.
Existence of a Global Plan to review and monitor the functions that must be
undertaken by the OR function, to enable to firm to apply and monitor the
models required.
Existence of an operational events manual that is available to the all levels of
staff.
Development and formation of plans and processes to enable all levels of staff to
identify and analyze operational events.
Establishment of processes for the identification and collection of operational
data losses.
Implementation of a process for the analysis and identification of relevant bills or
accounting entries as part of the process of identifying OR losses, etc.
.
.
.
Existence of operational losses databases that allow the OR function to manage
information easily.
Establishment of reporting flows directed at the senior management and the
business units.
Existence of supervision processes that validate the performances carried out.
One of the key aspects when thinking about the implementation of advanced
measurement models is the need to have historical series of loss data (with a minimum
of three years and preferably five years or more) to provide input to statistical models
and capital models. Therefore, the internal auditors will focus on those aspects related
to the collection of operational losses, including:
.
.
.
.
.
.
.
Ensuring the databases contain the information required for the description of
the loss events.
The relationship between the operational losses collected and the accounting
records.
The establishment of approaches to assign OR losses to the business lines.
The existence of procedures for consolidating information on multiple losses
caused by a single main event.
The integrity of the historical series so that the full recovery of a loss does not
result in the deletion of the original event and it is possible to identify the events
that formed the historical series at a given date.
The evolution and development of analysis of the correlation of the historical
series of operational losses with regard to the internal and external factors that
influence OR.
The establishment and recording of analysis of the frequency and severity
curves of the operational events.
In this sense, the Bank of Spain (2006), in the document titled “Implementation and
validation of Basel II advanced approaches in Spain” indicates that “it is necessary that
the department of internal audit establishes a plan for the periodic revision of the
model to manage and measure OR”. Also, it establishes that “the entities that seek to
use the internal models to regulatory effects will send periodically to the Bank of Spain
formal statements.”
In that document, in their Annex 7, reference is made to the content that should
be included in the specific report to be sent by the internal auditor for the validation
of the internal model of OR. It should justify its opinion, expressing conclusions and
giving well-documented evidence about its confirmation on the following aspects:
.
.
Integration of the measurement system in the management process. Internal audit
will verify that the internal measurement system of OR is integrated in the day to
day management process.
Procedures and tools of managing OR. Internal audit will have to verify the
compliance to internal rules, controls and requirements related to this risk.
Measurement model of OR. Internal audit will keep in mind the specific purpose
for which the system of OR measurement is used, considering quantitative and
qualitative factors.
Technological environment and the applications. Internal audit will consider such
aspects as the adaptation of the technological infrastructures and the capture and
maintenance of the data.