Experiences in the Implementation of Credit Risk Management for Basel II

1. Experiences in the Implementation of Credit Risk Management for Basel II February 2008 PRMIA Shanghai Credit Risk Forum Gary Chen Principal, Credit Advisory Algorithmics, Fitch Group

2. Introduction • Purpose: To provide • An overview of sound practices for credit risk management under BIS II IRB Pillar 1 framework • A framework for model development and validation based on sound industry practices • A process for internal credit risk control aligned with regulatory principles and guidance

3. Agenda • Introduction • Pre-model Build Process • IRB Model Build Process • Rating System Validation Process • Credit Risk Control & Oversight

4. Migration Matrix Probability of Default (PD) Portfolio Monitoring Provisioning Pricing Profit Management Capital Allocation An Overview of credit risk measurement under BIS II Framework Internal Rating System Qualitative Evaluation Internal Rating Quantitative Evaluation Reporting to the Board Financial Data Stress Testing Loss Given Default (LGD) Risk Components Calculation of Credit Risk Amount Expected Loss (EL) Unexpected Loss (UL) Exposure at Default (EAD) Correlation Quantification of Credit Risk Internal Use Source: BoJ Sep 2005

5. BIS II – IRB Advanced Algo’s Advisory: From Pillar 1 to Pillar 2 From Expected Loss to Economic Capital Business Processes • Risk Appetite • Capital Allocation • Active Portfolio Mgmt. • Mitigation Strategies • Risk Averse Pricing • RAPM & VaR limits • EcoCap Optimisation Correlations Portfolio Approach • Regulatory Capital Requirement • Risk-Adjusted Pricing • Provisioning Policies • Limits Based on EL • Early Warnings Internal Rating Approach • Regulatory Capital Requirement • Risk-Adjusted Pricing • Provisioning Policies • Limits Based on EL • Early Warnings Diversification BIS II – IRB Foundation BIS II – Standard Approach • Regulatory Capital Requirement Inputs • External PD • Supervisory LGD • Supervisory EAD • Internal Estimate PD • Supervisory LGD • Supervisory EAD • Internal Estimate PD • Internal Estimate LGD • Internal estimate EAD • IRB Parameters • Macroeconomic Forecasts

6. A Simple Look on Pillar 1 IRB Tasks Estimation of Risk Components Architecture of an Internal Rating System, Internal Use Risk estimates (i.e., PD, LGD, EAD) predictive and accurate? “Use Test”*: Pricing, Portfolio Monitoring, Credit Risk Quantification? Quantitative Rating Model Qualitative Evaluation Validation Work * Use Test: IRB provision that requires ratings and default and loss estimates to “play an essential role” in the Institution’s credit approval, risk management, internal capital allocations and corporate governance functions. Source: BoJ Sep 2005

7. Overview of Pillar 1 IRB Tasks Initial Setup Ongoing & Iterative Process • Create credit /validation policy & procedural manual • Define Roles & Responsibilities • Form Independent Validation Group • Establish System of Controls 1. Review IRB Gap Assessment 2. Check Policies/Documents Internal Audit • Perform Development and Validation Activities for all IRB Components: Developmental Evidence Rating System Quantification Ongoing Monitoring Data Controls & Oversight Outcomes Analysis Board & Senior Management Independent Validation Group

8. The need for clear CRM Roles and Responsibilities Validation Group Internal Control Evaluation The Board Internal Audit Business Strategy Senior Management Risk Report Business Unit Risk Control and Management Department Support Department Business Development Risk Control Credit Policy Accounting Risk Quantification IT Credit Review and Control Human Resource Credit Process Legal Service Resource and IT Support Model Application Model Development, Maintenance and Monitoring

9. Agenda • Introduction • Pre-model Build Process • IRB Model Build Process • Rating System Validation Process • Credit Risk Control & Oversight

10. The Basics : First Things First • Pre-Model Build Process: to clarify: • Portfolio Type: • - Customer, product, industry or geographic region is model applicable to? • Model Purpose: • - Assign ratings? Establish credit limits? • 3.Model Performance Definition: • - Question model is trying to answer in quantifiable terms (e.g., predict default) • - Which parameters shall be estimated? • Model Type: • - What type of model shall be estimated? • 5.Definition of Default: • - How is default defined? • 6.Time Horizon: • - What time horizon is chosen?

11. Types of Rating Systems • Types of rating systems: • Expert-judgement based: qualitative/subjective ratings criteria; lacks transparency and consistency (e.g., LDPs); • Model-based: ratings based on objective risk factors using mathematical equations; • Constrained judgment or Hybrid: combines elements of both expert-judgment and model-based systems; and • Vendor Models: external third-party rating systems

12. Rating Philosophies • Per Basel II, IRB systems must have a valid risk grading methodology based on an assessment horizon reflected in the Institution’s rating philosophy ▪ Institution must specify a rating philosophy representing its business practices: e.g. Citigroup • Ratings represent the risk of default over the next year • Ratings take into account anticipated changes in borrowers conditions (stress-test) • Ratings are reviewed at a minimum once a year ▪ Difference in ratings philosophy is mostly due to “time horizon” (LT vs. ST) • ▪ Rating philosophy has important implications for validation and stress testing -- Must be clearly articulated in the Institution’s rating policy

13. IRB Minimum Requirements for Rating Systems • Rating systems are subject to IRB minimum requirements and must be validated against: • Supervisory Standards • Design Specifications • Operational Criteria

14. IRB Minimum Requirements for Rating Systems • IRB design requirements for rating systems: • Rating Dimensions • 2 separate distinct dimensions: (i) risk of borrower default; and (ii) transaction-specific factors (e.g., collateral, seniority, etc.) • Rating Structure • Meaningful distribution of exposures across grades w/ no excessive concentrations; minimum of 7 borrower grades &1 for defaulted • Rating Criteria • Detailed rating definitions and grade descriptions/criteria • Rating Assignment Horizon • 1 year forward horizon for PD estimation • Use of Models • Human review; vetting data inputs & representativeness • Documentation of a Rating System • Rating Systems’ Design & Operational Details(history of changes)

15. IRB Minimum Requirements for Rating Systems • IRB operational criteria for rating systems: • Coverage of Ratings • Obligors assigned ratings; exposures associated w/ facility rating • Integrity of Rating Process • Independence; ratings refreshed at least 1x p.a. • Rating Criteria • Detailed rating definitions and grade descriptions/criteria • Overrides • Policy stating by whom and when; identification & tracking • Data Maintenance • Collection & storage of borrower/facility characteristics; rating histories • Stress Tests • Evaluation of low probability/high impact events on required capital

16. Agenda • Introduction • Pre-model Build Process • IRB Model Build Process • Rating System Validation Process • Credit Risk Control & Oversight

17. Quantification: Supervisory Standards • The Institution must meet the IRB risk-quantification standards for own-estimates of PD, LGD and EAD: • PD estimates are 1 year forward-looking probabilities of default • LGD estimates reflect economic downturn conditions; and • EAD estimates are a long-run default weighted average EAD

18. Model Development Process Overview

19. Model Development Process Overview Data Collection Explanatory Analysis Create dummy variables Transformation / Preparation of Variables Variable selection Estimation Performance Credit sense of coefficients Tests No Performance Yes Implementation

20. Basel Alert: Data Collection and Maintenance Systems • The Institution must have processes to collect data, assess and manage data quality and integrity and must meet key supervisory standards regarding data maintenance: • Collect Data Over Life of Loan: “cradle to grave” collection of data for obligors and facilities • Collect Rating Assignment Data: significant quantitative and qualitative factors for both obligors and facilities • Support of IRB System: data collected must be of sufficient depth, scope, and reliability to: • Develop and validate IRB system processes, • Develop and validate parameters, • Refine the IRB system, • Apply improvements historically, • Calculate capital ratios, • Produce internal and public reports, and • Support risk management

21. Data Infrastructure: Managing Quality and Integrity • Assurance of data quality and integrity require the following: • Documentation: • Formalize process to ensure data integrity • Articulate requirements for delivery, retention and renewal of inputs to data warehouse • Definitions: • Develop and document comprehensive data dictionary • Electronic Storage: • Store data in electronic format to facilitate analysis, validation and disclosure requirements • Regular Review and Refreshment: • Conduct data quality assessment at least annually • Review IRB requirements regarding “accuracy” (e.g., timeliness),“completeness” (i.e., data gaps) and “appropriateness”

22. Agenda • Introduction • Pre-model Build Process • IRB Model Build Process • Rating System Validation Process • Credit Risk Control & Oversight

23. Basel Validation Expectations • “Institutions must have a robust system in place to validate the accuracy and consistency of ratings systems and process, and estimation of all relevant risk components. An institution must demonstrate to its supervisor that the internal validation process enables it to assess the performance of internal rating and risk estimation systems consistently and meaningfully”. • [Source: BCBS, IC §500]

24. Broad Approachto Validation Broad Interpretation: Rating System & Process Internal Validation by Individual Bank Validation of Rating System Validation of Rating Process Model Design Risk Components Data Quality Report Problem & Handling Internal Use by Credit Officers Backtesting Benchmarking PD LGD EAD Source: BCBS Working Paper No. 14– Feb 2005]

25. Validation Activities and IRB Components Validation activities IRB Upon operation Upon development validation Development evidence Continuous monitoring Outcome analysis Basel minimum requirements Model Completeness of development report Model Monitoring item Backtesting validation Stress Test Model performance evidence Model performance Benchmark analysis ( Power / Stability etc,. ) ( Power / Stability Quantitative Model design and logic Data maintenance , Data adequacy Data Model operation procedure Support structure BOD reporting Responsibility , Governance Governance review validation Actions based on Control ( authority/responsibility/ limitation/documentation ) Internal use Validation results

26. Ensure integrity of IRB processes & systems PURPOSE (WHY) Confirm predictiveness of PD, LGD, EAD Review IRB compliance All IRB components Models SCOPE (WHAT) Inputs (Data) & Outputs (Estimates) Rating Process (i.e., Independence) Control & Oversight Mechanisms (e.g., Internal Audit, Use) Independent validation team MEMBERS (WHO) Experts in credit and/or modeling Qualitative and Quantitative techniques Review of documents Meet w/ various depts. (e.g., risk mgmt, audit, etc.) Determine model type & rating philosophy METHOD (HOW) Check logic behind model (programs) Review sample data Benchmarking (i.e., compare w/ external sources) Backtesting (i.e., estimates v. actual) Regular and Periodic Basis At least 1x per year TIMING (WHEN) Changes in model, data or portfolio Initial model development Summary: Guiding Principles for Validation √ √ √ √ √

27. Agenda • Introduction • Pre-model Build Process • IRB Model Build Process • Rating System Validation Process • Credit Risk Control & Oversight

28. Corporate Governance and Oversight • Prerequisites for the Board and Senior Management • General understanding of regulatory expectations • General understanding of the institution’s proposal to meet such expectations • General understanding of the use of IRB risk estimates in capital management • Good understanding of the internal rating system design and operation • Delegation • Delegate to an appropriate party • Defined roles and responsibilities for delegated tasked if appointed

29. Corporate Governance and Oversight • Senior management’s IRB responsibilities • Resource management • Adequate training • Integration of IRB systems into Institution’s credit risk management processesand culture • Ensure that IRB ratings/estimates are put to proper use • Approve and track material differences between established policies and actual practice • Review performance and predictive power of IRB estimates • Advise the Board of material changes or exceptions from established policies

30. Controls and Oversight: Reporting Requirements • Validation Report to Management: • Upon completion of its validation activities, validation group must submit to senior management and the Board its findings and recommendation for actions • Frequency of reporting: • Validation Policy and/or Operational Manual should set the timetable, which at minimum is once per annum

31. Regulators Concerns: Infrastructure Gaps • Source: Y K Choi, Deputy Chief Executive HKMA November 2007 • Observed Challenges facing Banks: • Knowledge gaps • Insufficient default and loss data for model development and validation • Inadequate awareness on importance of data integrity • Revamp of risk management practice, culture, internal controls and oversight framework • Complexity of CAR calculation and reporting engine

32. Regulators Concerns: PD Deviations across banks Illustration: UK FSA Working Paper September 2007

33. Key Messages • Basel II’s purpose is the quantification of Capital at Risk • This requires forward-looking risk estimates • Fewer international banks than expected have so far achieved IRB Pillar 1 compliance. This calls for more complete and rigorous on-going Validation processes • In-house data is seldom sufficient. Chinese banks will benefit from participating in Chinese data consortiums • The on-going management of capital resources in relation to risks taken requires robust database and risk system infrastructures.

34. Questions? Further Contacts: Gary Chen Ph.D. Principal, Credit Advisory Algorithmics (Hong Kong) Ltd. 28th Floor, Tower Two, Lippo Center 89 Queensway, Central, Hong Kong Tel : (852) 2263 9970 Fax : (852) 2530 3260 gary.chen@algorithmics.com