A brief history in credit risk in banking
Banks have been looking at credit risk for many years, but are they any closer to getting the right measures? John Mongelard explores the story so far.
Digitalisation and technology threaten to disrupt nearly every part of our economy and banking is no different. Large, incumbent banks face the twin threat of smaller start-up challenger brands and competition from big tech firms. New fintechs are nibbling away at all areas of the banking pie, particularly on the payments side. Their success will not help incumbent bank profitability, at a time of low interest rates and low growth prospects.
One look at the inverted yield curves across the globe shows the difficulties facing many banks. Strategic risk and technology risk are the biggest systemic risks facing all banks today.
But that’s not the way backward-looking regulators and standard setters necessarily see things. The crises of the past were based on credit risk events, so that is the lens regulators use and it probably reflects their objectives around micro stability — the focus on individual bank survival (or how to ensure an orderly wind-down).
Rainy day
Using this lens, credit risk is by far the biggest risk for banks today. It accounts for a significant portion of it, as well as the majority of regulatory capital. It is therefore important for a bank’s board to have, and to be able to demonstrate, a clear understanding of how credit risk is measured.
Yet modelling of this important risk is disjointed, as accountants and bank regulators have gone in similar, but not identical, directions. These twin demands make it harder for senior management at a bank to understand credit risk measurement. There is a chance that this confusion could lead to higher credit losses, poor strategy or expensive and cumbersome processes.
So why is there a disjointed approach and the danger of confusion? In theory there should not be a problem. Ideally, regulatory rules around capital are not meant to overlap with the purpose and intent of credit provisions for financial reporting. The text books say that credit provisions are for expected losses and capital is for unexpected loss; a rainy day.
That theory has been upset, however, by the seismic nature of that last rainy day – the global financial crisis. It led to both standard setters responding in their respective spheres, but in ways that may coincide. They now both use much of the same language, but the exact meaning is very different for each set of authors.
How did we get here?
First let’s look at what has happened with regulatory capital and credit risk modelling.
Regulators first introduced new absolute measures of credit risk, with the new internal rating based approaches (IRB), in 2006. These Basel II rules saw the advent of what are now the main credit risk components, Probability of Default (PD), Loss Given Default (LGD) and Exposure at Default (EaD).
But their longevity was immediately challenged by the events of 2007 and 2008 and the global crisis. Almost immediately after the birth of PD, regulators were forced to pivot and began to look at systemic conditions and overall portfolio default rates. We saw the beginning of stress testing internationally and another new measure of credit risk.
Regulatory stress tests look at whether banks can survive a typically five-year long stress. It looks at how a bank will meet increasing (pro-cyclical) regulatory capital requirements as well as whether the bank can survive the direct impact of weaker economic conditions on P&L (primarily through provisions).
But looking at that P&L and trying to guess how it will behave in a stress has been made even more difficult with the introduction of IFRS 9 (2018). The old rules of incurred loss (IAS 39) were an easier modelling task. To come up with your incurred losses you could just look at historic loss rates and use them to provide a benchmark. IFRS 9, in contrast, is an expected loss approach and asks banks, among other things, to model how loan staging might respond in a crisis.
The result of this piecemeal and iterative approach to regulation and accounting means we now have a smorgasbord of terms and approaches. PD is used by both accountants and regulators. But, for the regulator, PD is a through-the-cycle rate with a 12-month outlook, while for the accountant it is a “point-in-time” measure with a lifetime outlook. This could be confusing and not immediately apparent to those who have to sign-off on bank models or their results.
And another thing...
And don’t get me started on the fact that so many teams have adopted a siloed approach to model design — accountants and risk teams have been working separately as new project teams were created. Then there are data quality problems. Can you show me a bank that has no gaps against Basel’s BCBS 239 data governance standards?
Finally, there are the validation challenges that mean we are seeing unexpected results. For one bank looking at the same assets, they have their prudential regulatory through-the-cycle PD smaller than their point-in-time accounting PD.
Ahead of the next downturn, there is therefore an opportunity to improve the understanding, use and interaction of the various credit risk models and for the senior management teams in banks to build greater awareness of these issues, while overseeing the building of stronger modelling processes.
Together with GARP, ICAEW has written a paper to raises awareness and understanding of the different credit risk modelling requirements. It also sets out some of the building blocks to help banks develop a more coherent approach to credit risk modelling.
About the author
John Mongelard, manager, risk and regulation, Financial Services Faculty
