Financial Stability 1/2003
5 Operational risk
Ramme:
- The Basel Committee's work in the field of operational risk
Over the past few years, Norges Bank and the banking industry have introduced
several measures to reduce liquidity and credit risk in the Norwegian payment
system.3 Credit and liquidity risk related to
domestic payments is therefore limited under normal circumstances. In addition,
credit risk associated with settlement of banks’ foreign exchange positions
will be reduced when the Norwegian krone is included in the international foreign
exchange settlement system CLS.4 However, the
occurrence of operational disruptions indicates that operational risk continues
to represent an important form of risk in the payment system.
3 See Financial Stability 1/2002.
4 See Financial Stability 2/2002.
Operational risk
Operational risk can be defined as “the risk of loss resulting from
inadequate or failed internal processes, people and systems or from external
events”. The definition includes legal risk, but excludes reputational
risk. A number of developments indicate that operational risk has increased.
Examples of this are banks’ increasing dependence on IT-based systems,
resulting in vulnerability to failures in these systems, and acquisitions
or mergers, which often require an integration of environments and systems
that were not designed to function in combination.
Examples of operational failure in the payment system
There have been a number of incidents in recent years that illustrate the vulnerability
of payment systems to operational failure. In Norway, there was an
operational disruption at EDB Fellesdata on 2 August 2001, causing considerable
problems in relation to ATMs, balance checks, internet banking, account information,
telebanking and company terminals. The clearing and settlement system for a
number of small and medium-sized savings banks was also affected. This incident
had an impact on 114 savings banks and an estimated 1 million users, and systems
were not fully restored to normal until 9 August. In this case, it was possible
to reconstruct transaction data, which helped to limit the financial consequences
of the disruption in operations. Banks were able to limit the consequences for
their customers by providing services through their branch networks. The disruption
at EDB Fellesdata must nevertheless be regarded as an example of major operational
failure.
In Sweden, Nordbanken’s computer system failed on 27 December
2000 and the problem was not fully rectified until 3 January 2001. Parts of
the system functioned during this period, limiting the adverse effects of the
failure. However, some solutions for customer payment were affected. In some
cases, it was not possible to make debit card purchases and withdrawals from
ATMs, and the bank was no longer able to execute giro payments in the normal
way. To mitigate the adverse effects for customers, the withdrawal limits for
credit cards were raised and it was possible to make giro payments at other
banks at no extra cost. The consequences of the operational failure at Nordbanken
were therefore not serious.
In Denmark, the IT systems at Danske Bank failed on 10 March 2003,
and they were not restored to normal operational status until 17 March. The
operational failure affected the bank’s systems for foreign exchange,
equity, bond and money market trading, and Internet banking was only partially
operative. For ordinary customers, the most noticeable effect was delayed payments
to and from the bank, resulting, among other things, in the delay of some wage
payments. However, other private banks provided assistance so that wage payments
could be effected with limited delays. The operational failure at Danske Bank
also had an impact on Fokus Bank in Norway, which is a subsidiary of Danske
Bank. Branches and subsidiaries in other countries were also affected. The failure
at Danske Bank is thus an example of how operational problems can spread to
other countries.
When one individual bank experiences operational failure, the liquidity in
the banking system may accumulate in this bank because the bank receives payments
without being able to transfer payments itself. In the case of Nordbanken, this
problem did not arise because reserve solutions enabled the bank to complete
all its transactions. The systems failure at Danske Bank caused considerable
delays in the bank’s payments, and this generated uncertainty about the
liquidity of the other banks. Danmarks Nationalbank, the central bank of Denmark,
therefore injected DKK 5bn into the market as extra liquidity. Danske Bank also
transferred liquidity to the other Danish banks based on forecasts, and similar
transfers were made by Fokus Bank and Danske Bank’s branch in Norway.
Handling the situation in this way prevented the failure at Danske Bank from
having any adverse effects on money market liquidity in Denmark and Norway.
Limiting operational risk in the Norwegian payment system
The banking industry’s establishment of a joint infrastructure and banks’
outsourcing of IT activities may have increased the payment system’s vulnerability
to operational disruption. Both the supervisory authorities and the banking
industry are therefore working systematically to reduce operational risk in
the payment system.
- Pursuant to the Payment Systems Act, Norges Bank is respon-sible for oversight
of the interbank systems that are subject to authorisation. The Act allows
Norges Bank to require changes if the systems do not promote operational stability.
- Operational disruptions in the payment system are registered as they occur
and categorised by the operator of the Norwegian Interbank Clearing System5
(i.e. the Banks’ Central Clearing House, BBS), then reviewed by the
banks’ joint bodies. Each abnormality is followed up in order to increase
awareness of causes and consequences.
- The key participants in the payment system conduct regular emergency planning
exercises. If deficiencies are detected during these exercises, contingency
procedures and technical equipment must be upgraded. In addition, the individual
system participants are responsible for conducting these types of exercises
for their own operations.
- The NICS Operator Office has introduced certification for banks that send
transactions for settlement at Norges Bank. Requirements for certification
include contingency procedures for abnormal situations. The information given
must be confirmed by the bank’s senior management and any internal auditor.
- Norges Bank has established a Contingency Committee for Financial Infrastructure.
The Committee is headed by Norges Bank and its primary tasks are i) to establish
and coordinate measures to prevent and resolve crises and other situations
that may lead to problems in the financial infrastructure and ii) recommend
ways to coordinate contingency work in the financial sector.
5 NICS is the central system for netting transactions
between Norwegian banks.
In addition to these measures, the Banking, Insurance and Securities Commission
has general responsibility for supervising the financial services industry under
the Financial Supervision Act. Norges Bank and the Banking, Insurance and Securities
Commission have organised a system for joint supervision of interbank systems
that are subject to authorisation.
The work to improve operational stability has generated results, but some disruptions
still occur. Charts 5.1 and 5.2 show a marked increase in a calculated consequence
index for disruptions in the first quarter of 2003. This is due primarily to
problems in Danske Bank, which had an impact on Focus Bank and Danske Bank’s
subsidiary in Norway. Requirements with regard to operational stability will
become more stringent, partly as a result of the inclusion of the Norwegian
krone in CLS. It is therefore very important that efforts to improve operational
stability contribute to a further reduction in the number of abnormal situations.
Chart 5.1 Chart
5.2
The Basel Committee's work in the field of operational
risk
The Basel Committee on Banking Supervision has had a strong focus on operational
risk in recent years. The Committee will stipulate explicit capital adequacy
requirements for operational risk in the new Capital Accord (Basel II), and
it has drawn up 10 recommendations for how banks should manage operational
risk.1 The Committee stresses that the
senior management and board of directors in banks should develop strategies
for managing and monitoring operational risk, that a culture for limiting
risk should be established, that effective reporting procedures should be
established and contingency plans drawn up. The recommendations stress that
operational risk should be managed as a distinct risk category and that it
should apply to all of the bank’s activities.
1 Sound Practices for the Management
and Supervision of Opera-tional Risk, BIS 2003.
In order to determine capital adequacy requirements for operational risk,
the Committee needs information concerning the size of losses that banks can
expect due to this risk. An important part of the Committee’s work has
therefore consisted of obtaining information about the number and size of
banks’ losses related to operational failure, the business lines affected
by the losses, causes (fraud, technical malfunction, etc) and to what extent
the losses are compensated by insurance pay-outs or by other means. In March
2003, the Committee published a report presenting the preliminary results
of this work.2 The report shows that banks
that supplied data (89 banks) had more than 47 000 losses that exceeded 10
000 and were related to operational risk in 2001. About 2% of these losses
exceeded 1 000 000. This is the second survey on banks’ operational
risk that has been conducted by the Committee, but the Committee stresses
that the methods for measuring this risk are still in the developmental stage
in a number of banks. The report should therefore be regarded as a description
of the data collected, rather than as a quantification of operational risk
at a more general level.
2 The Loss 2002 Data Collection Exercise
for Operational Risk: Summary of Data Collected, BIS 2003.
Under the draft New Basel Capital Accord (Basel II), the individual bank
will be able to calculate its own capital requirements related to operational
risk based on three different approaches. Most Norwegian banks will probably
use the simplest approach, where the capital requirement will be calculated
on the basis of the bank’s gross income. In the more advanced version
of this approach, the capital requirement will be calculated on the basis
of gross income for each business line. If this method is used, a bank’s
capital requirement will be more sensitive to the bank’s risk profile.
Using the two simplest approaches, the average capital requirement for operational
risk will probably account for about 12% of banks’ total capital requirement.
The most advanced approach allows banks to use their own systems and methods
for calculating the capital requirement. No lower limit for capital requirements
has been set for this approach, but the systems and methods used to calculate
the capital requirement must be approved by the authorities.