CIA Annual Meeting Session 4405

1. Future of Credit Risk Management: Supervisory Approach to Basel II CIA Annual MeetingSession 4405 Ben Gully Director, Basel Implementation Division Office of the Superintendent of Financial Institutions June 29, 2005

2. Basel II General Overview OSFI Approach to IRB Implementation Key Issues

3. Basel II: Background • Basel I • “One-size-fits-all” • Market risk and credit risk • Basel II • Tailored approach to internationally active or significant banks • Market, credit and operational risk (all 3 risks are “explicit” in regulatory capital charges) • ‘Advanced’ approach to credit risk • Supervisory Review Process • Market discipline • Moving from CP1 (1999) to Basel II implementation (2007) and beyond • Consultative period • Parallel reporting • Implementation • Transition period • Implications • Financial institutions • Rating agencies • Supervision • Market discipline

4. Basel II: Structure Basel II Framework Pillar I Minimum Capital Requirements Pillar II Supervisory Review Pillar III Market Discipline • Minimum capital level • Credit risk (Internal Ratings Based Approaches and Standardized Approaches) • Internal ratings • External ratings • Credit risk mitigation • Operational risk • Market risk • Bank internal capital assessment (vs. risk profile) • Comprehensiveness and conservatism • Internal controls • Monitoring and reporting • Board and management oversight • Supervisory review and intervention • Disclosure requirements • Risk profile • Capital adequacy and structure • Risk management practices

5. Basel II: Pillar I – Minimum Capital Requirements

6. Basel II: Three Approaches for Credit Risk • Increasing levels of risk-sensitivity Similarity with Basel 1 Risk Sensitivity Note: “Internal estimates” means banks’ own estimates * PD – Probability of Default; LGD – Loss Given Default; EAD – Exposure at Default

7. Basel II: IRB Minimum Requirements • Risk Rating Systems’ Design and Operations • Broad definition of RRS • Two dimensional RRS: Borrower – PD, and Facility – LGD • Rating philosophy • Rating process - independence and replicability • Data maintenance of all material and relevant risk drives of credit risk • Stress testing and capital adequacy • Corporate Governance and Oversight • Board and senior management • Internal audit • Independence of Credit Risk Control Unit (CRCU)

8. Basel II: IRB Minimum Requirements, cont’d • Use of RRS • Use of internal estimates • Track record of use • Risk quantification – predicting credit risk metrics based on internal experience • Probability of Default (PD) • Long-run average of one-year default rates for borrowers in a given grade • Loss Given Default (LGD) • LGD and economic loss • LGD reflects downturn conditions • Use and retention of historical experience • Exposure at Default (EAD) • Expected gross exposure of facility upon default of the borrower • Use and retention of historical experience • Validation • Integrity of validation process • Broad approach to validation • Quantitative validation tools

9. Basel II: Complexity of IRB Implementation • IRB approach uses parameters of banks’ credit risk rating systems to drive regulatory capital • “The term “rating system” comprises all of the methods, processes, controls, and data collection and IT systems that support the assessment of credit risk, the assessment of internal risk ratings, and the quantification of default and loss estimates.” Basel II • Multiple aspects of implementation: • Organization (risk management, corporate governance and oversight) • Credit risk processes and procedures • Data • IT systems • Business operations • Capital planning

10. Gap Analysis Basel II: Key Steps of IRB Implementation Scope Assessment • Organization (risk management, corporate governance and oversight) • Credit risk processes and procedures • Data • IT systems • Business operations • Capital planning Implementation Project Plan Rollout Plan Implementation Use Test Self-Assessment Approval Ongoing Monitoring

11. Basel II General Overview OSFI Approach to IRB Implementation Key Issues

12. OSFI Approach: Five Phases

13. Basel II General Overview OSFI Approach to IRB Implementation Discussion Points

14. IRB Implementation: Discussion Points • Overall Implementation • Enterprise-wide implementation - business management, risk management, IT, internal audit, finance, etc. • Implementation on a consolidated basis – all legal entities, asset exposures and jurisdictions • Resource management • Timelines • Self-assessment • Project Management Office • Coordination of multiple stakeholders - business management, risk management, finance, IT, etc. • Budget and resource planning • Change management – internal and external stakeholders

15. IRB Implementation: Discussion Points, cont’d • Corporate Governance and Oversight • Role of internal audit • Role of board and senior management and associated training • Independence • Reporting • Cross-border Implementation: “Home/ Host” and “Host/ Home” • Implementation across multiple jurisdictions • Coordination of approval and ongoing supervision • Materiality • Information sharing

16. IRB Implementation: Discussion Points, cont’d • Corporate and Retail Risk Rating Systems • RRS metrics • Rating philosophy – definition, documentation and operationalization • Validation framework • Use test • Risk mitigation • IT • Identification of supporting architecture • System integration and system updates • Data marts and data migration • Capital computation and management • Data • IRB data requirements – quality and quantity • Historical retention of loss experience and data availability • Risk quantification • Reconciliation • Data management framework

17. Questions