Community
It has now been more than three years since BIS published their paper back in 2013 in response to the financial crisis, with the snappy title of ‘BCBS239: Principles for effective risk data aggregation and risk reporting’ ¹. Since then, the world’s largest banks have worked towards the compliance deadline of 1 January 2016, but with only limited success.
As of January 2017 only a single G-SIB out of 20 declared full compliance, with a further one due by March 2017 ². The other 18 are ‘in remediation’ requiring more work to be able to declare full compliance.
So what are the approaches to delivering and sustaining compliance for BCBS239 and similar regulatory programmes?
Governance and IT infrastructure
Defining what are the key risks facing the institution (both financial and non-financial), and assigning board level accountability and responsibility for managing them is the starting point. Set at an enterprise level this gives the chief risk officer (CRO) and his supporting IT team the boundary of material risk to measure. This is applied through policies, standards and controls.
With BCBS239, the Enterprise IT infrastructure and architecture needs to support the core principles from front-to-back; including managing the all data, from the first system of record through to producing and delivering the required management reports.
Risk data aggregation
Many banks struggle to achieve the level of automation and straight through data management and control called for by the principles of the regulation – this needs to be integral to the processing of risk data, including measuring completeness, accuracy and timeliness, which in turn has to be reported to the consumers of the risk reports. Where complex analytics and modelling are required, (e.g. risk scenario and stress testing for capital and impairment modelling), this too often takes place outside of any formally supported IT infrastructure.
Risk reporting
Maintaining the scope and improving the delivery of risk reports are also major challenges. Many banks produce hundreds of obsolete reports and struggle to adapt them to new and emerging risks. Delivering such reports in an appropriate and intuitive form for the end user is key – taking data and presenting it in a spreadsheet supported presentation is still far too common; adding time (and expense), and the need to quality check the process. Reporting should also include an external risk assessment, and include periodic reviews to ensure the reporting is still relevant.
In addition, many banks who can satisfactorily produce reports under ‘normal’ market conditions, struggle to be able to produce timely and relevant reporting in ‘crisis’ conditions. As such, the processes for reporting in crisis situations should be periodically reviewed and tested.
A better way?
The key to achieving compliance is to clearly define the capabilities, artefacts, processes and components required in order to do so. These should be traceable back to the principles, reviewed by senior management, and agreed. The key to achieving compliance with the principles is to build in automation and flexibility from the start, to allow risk data aggregation and reporting to adapt to new risks, as well as providing long term views of established risks and exposures. This approach must be integrated into all risk IT programmes, especially in multi-business, multi-jurisdictional firms. Tactical remediation (especially manual compensating controls) should be avoided, as such workarounds tend to persist and will prevent full compliance in the longer term. Building best practice into ongoing processes is important – compliance is then part of peoples’ roles, not an additional overhead, making ongoing ‘business-as-usual’ compliance achievable.
Being transparent regarding the state of compliance with the regulator is also important – as is ensuring that planning for compliance is properly resourced and funded, with clear and achievable milestones, where there is still work to be completed.
In essence the key factors in achieving BCBS239 compliance are to do good by:
For those firms who take such an approach to BCBS239, it will ultimately be possible to achieve compliance, do good and improve.
---
¹ https://www.bis.org/publ/bcbs239.pdf
² https://www.bis.org/bcbs/publ/d399.pdf
This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.
Oleksandr Strozhemin Co-founder and CEO at Trinetix
13 August
Elaine Mullan Head of Marketing and Business Development at Corlytics
12 August
Abhinav Paliwal CEO at PayNet Systems- A Neo Banking Software Platform
Donica Venter Marketing coordinator at Traderoot
Welcome to Finextra. We use cookies to help us to deliver our services. You may change your preferences at our Cookie Centre.
Please read our Privacy Policy.