Operational risk

The Committee believes that operational risk is an important risk facing banks and that banks need to hold capital to protect against losses from it. Within the Basel II framework, operational risk is defined as the risk of losses resulting from inadequate or failed internal processes, people and systems, or external events. This is another area where the Committee has developed a new regulatory capital approach. As with credit risk, the Committee builds on banks' rapidly developing internal assessment techniques and seeks to provide incentives for banks to improve upon those techniques, and more broadly, their management of operational risk over time. This is particularly true of the Advanced Measurement Approaches (AMA) to operational risk described below.

Approaches to operational risk are continuing to evolve rapidly, but are not likely in the near term to attain the precision with which market and credit risk can be quantified. This situation has posed obvious challenges to the incorporation of a measure of operational risk within pillar one of the New Accord. Nevertheless, the Committee believes that such inclusion is essential to ensure that there are strong incentives for banks to continue to develop approaches to operational risk measurement and to ensure that banks are holding sufficient capital buffers for this risk. It is clear that a failure to establish a minimum capital requirement for operational risk within the New Accord would reduce these incentives and result in a reduction of industry resources devoted to operational risk.

The Committee is prepared to provide banks with an unprecedented amount of flexibility to develop an approach to calculate operational risk capital that they believe is consistent with their mix of activities and underlying risks. In the AMA, banks may use their own method for assessing their exposure to operational risk, so long as it is sufficiently comprehensive and systematic. The extent of detailed standards and criteria for use of the AMA are limited in order to accommodate the rapid evolution in operational risk management practices that the Committee expects to see over the coming years.

The Committee intends to review progress in regard to operational risk approaches on an ongoing basis. It has been strongly encouraged by the advances made at those banks that have been developing operational risk frameworks consistent with the spirit of the AMA. Management at these banking organisations has concluded that it is possible to develop a flexible and comprehensive approach to operational risk measurement within their firms.

Internationally active banks and banks with significant operational risk exposure (for example, specialised processing banks) are expected to adopt over time the more risk sensitive AMA. Basel II contains two simpler approaches to operational risk: the basic indicator and the standardised approach, which are targeted to banks with less significant operational risk exposures. In general terms, the basic indicator and standardised approaches require banks to hold capital for operational risk equal to a fixed percentage of a specified risk measure.

In the basic indicator approach, the measure is a bank's average annual gross income over the previous three years. This average, multiplied by a factor of 0.15 set by the Committee, produces the capital requirement. As a point of entry for the capital calculation, there are no specific criteria for use of the basic indicator approach. Nevertheless banks using this approach are encouraged to comply with the Committee's guidance on sound practices for the management and supervision of operational risk, which was released in February 2003.

In the standardised approach, gross income again serves as a proxy for the scale of a bank's business operations and thus the likely scale of the related operational risk exposure for a given business line. However, rather than calculate capital at the firm level as under the basic indicator approach, banks must calculate a capital requirement for each business line. This is determined by multiplying gross income by specific supervisory factors determined by the Committee. The total operational risk capital requirement for a banking organisation is the summation of the regulatory capital requirements across all of its business lines. As a condition for use of the standardised approach, it is important for banks to have adequate operational risk systems that comply with the minimum criteria outlined in CP3.

Banks using the basic indicator or standardised approaches to operational risk are not permitted to recognise the risk mitigating impact of insurance. However banks using the AMA are permitted to do so subject to certain conditions.