Article 3: Systems & Controls
General
- 1. The Board must ensure compliance with a documented set of internal policies, controls and procedures concerning the operation of the market risk measurement system. Documentation in the form of a market risk manual or policy must provide a useable and understandable overview of the basic principles of the market risk management system and an explanation of the empirical techniques used to measure market risk.
Risk Factors
- 2. A Bank must specify in its market risk measurement system an appropriate set of market risk factors (market rates and prices that affect the value of the Bank’s market-related positions) that are sufficient to capture the risk inherent in the Bank’s portfolio of on- and off-balance sheet trading positions.
Interest Rates
- 3. A Bank must specify a set of risk factors corresponding to interest rates in each currency in which the Bank has interest-rate-sensitive on- or off-balance sheet positions. The number of risk factors used must be driven by the nature of the Bank’s trading strategies and must include, at a minimum, the following:
- a. Modelling of the yield curve using one of a number of generally accepted approaches, for example, by estimating forward rates of zero coupon yields.
- b. Dividing the yield curve into various maturity segments in order to capture variation in the volatility of rates along the yield curve. There typically will be one risk factor corresponding to each maturity segment.
- c. For material exposures to interest rate movements in the major currencies and markets, modelling the yield curve using a minimum of six risk factors. The number of risk factors used ultimately must be driven by the nature of the Bank’s trading strategies. For instance, a Bank with a portfolio of various types of securities across many points of the yield curve and that engages in complex arbitrage strategies would require a greater number of risk factors to capture interest rate risk accurately.
- 4. The risk measurement system must incorporate separate risk factors to capture spread risk (e.g. between bonds and swaps). These include but are not limited to specifying a completely separate yield curve for non-government fixed-income instruments (for instance, swaps or municipal securities) and estimating the spread over government rates at various points along the yield curve.
- 3. A Bank must specify a set of risk factors corresponding to interest rates in each currency in which the Bank has interest-rate-sensitive on- or off-balance sheet positions. The number of risk factors used must be driven by the nature of the Bank’s trading strategies and must include, at a minimum, the following:
Exchange Rates
- 5. A Bank must specify risk factors corresponding to the exchange rate between the domestic currency and individual foreign currencies in which its positions are denominated.
Equities
- 6. For equity prices, there must be risk factors corresponding to each of the equity markets in which the Bank holds significant positions. The sophistication and nature of the modelling technique for a given market must correspond to the Bank’s exposure to the overall market as well as its concentration in individual equity issues in that market.
- 7. At a minimum, there must be a risk factor that is designed to capture market-wide movements in equity prices (e.g. a market index). Positions in individual securities or in sector indices could be expressed in “beta-equivalents”2 relative to this market-wide index. Alternatively, a Bank may identify risk factors corresponding to various sectors of the overall equity market (for instance, industry sectors or cyclical and non-cyclical sectors), or specify risk factors corresponding to the volatility of individual equity issues.
2 A “beta-equivalent” position would be calculated from a market model of equity price returns (such as the Capital Asset Pricing Model) by regressing the return on the individual stock or sector index on the risk-free rate of return and the return on the market index.
Commodities
- 8. A Bank must specify risk factors corresponding to each of the commodity markets in which it holds significant positions. A Bank’s commodity risk factors must, at a minimum, include the following:
- a. Directional risk, to capture the exposure from changes in spot prices arising from net open positions;
- b. Forward gap and interest rate risks, to capture the exposure to changes in forward prices; and
- c. Basis risk, to capture the exposure to changes in the price relationships between two similar, but not identical, commodities.
- 9. For a Bank with relatively limited positions in commodity-based instruments, a less complex specification of risk factors would be acceptable. Such a specification would likely entail one risk factor for each commodity price to which the Bank is exposed. In cases where the aggregate positions are quite small, it might be acceptable to use a single risk factor for a relatively broad sub-category of commodities (for instance, a single risk factor for all types of oil.) For more active trading, the model must also take account of variation in the “convenience yield” between derivatives positions such as forwards and swaps and cash positions in the commodity.
- 8. A Bank must specify risk factors corresponding to each of the commodity markets in which it holds significant positions. A Bank’s commodity risk factors must, at a minimum, include the following:
Options
- 10. If a Bank’s risk appetite statement includes taking option positions, the market risk measurement system must specify risk factors corresponding to the implied volatilities of those options, to capture the risk of gain or loss resulting from changes in volatility of those positions.
- 11. The following criteria apply to the measurement of options risk:
- a. Bank’s models must capture the non-linear price characteristics of options positions; and
- b. Each Bank’s risk measurement system must have a set of risk factors that captures the volatilities of the rates and prices underlying option positions, including Vega risk. Banks with relatively large and/or complex options portfolios must have detailed specifications of the relevant volatilities.
Internal Review
- 12. The Board-approved policies must provide for an independent review by the internal audit function of the market risk measurement system at least annually. The review must include both the activities of the business trading units and of the independent risk management function. At a minimum, a review must specifically address the following:
- a. The organization of the market risk management function, adequacy of the documentation of the market risk management system and process and the approval process for risk pricing models and valuation systems used by front-and back-office personnel;
- b. The scope of the market risks captured by the market risk measurement system’s models; the accuracy and appropriateness of the risk measurement system (including any significant changes); the accuracy and completeness of position data; the accuracy of calculation and risk transformation calculations; integration of market risk measures into daily risk management; accuracy and appropriateness of volatility and correlation assumptions and (if using the historical simulation approach) calculations of historical rate movements; and the integrity of the management information system with respect to market risk;
- c. The verification of the consistency, timeliness and reliability of the data sources used to run internal models, including the independence of such data sources;
- d. The validation of any significant change in the market risk measurement process, including the evaluation of conceptual/methodological soundness, as well as developmental evidence;
- e. Evidence of ongoing model monitoring, including process verification and benchmarking;
- f. The verification of the model’s accuracy through frequent back-testing of outcomes analysis, including key internal parameters; and
- g. The process used to produce the calculation of market risk capital.
- 12. The Board-approved policies must provide for an independent review by the internal audit function of the market risk measurement system at least annually. The review must include both the activities of the business trading units and of the independent risk management function. At a minimum, a review must specifically address the following:
Models
- 13. The Board must ensure that Board-approved policies adequately provide for market risk measurement methodologies commensurate with the risk profile, nature, size and complexity of the Bank’s business and structure. A Bank that has a trading book must have a robust modelling framework. Development, internal approval and ongoing use of models and other market risk management methodologies must be governed by Board-approved policies and procedures, which at a minimum must address initial and ongoing validation, valuation and independent review by the internal audit function.
- 14. The risk management function must produce and analyse daily reports on the output of the Bank’s market risk measurement models, including an evaluation of the relationship between measures of risk exposure and trading limits. This function must be independent from business trading units and must report directly to Senior Management.
- 15. A Bank’s internal risk measurement models must be closely integrated into the day-to-day risk management process of the Bank. Model output must be an integral part of the process of planning monitoring and controlling the Bank’s Market Risk profile.
- 16. The Market Risk measurement system must be used in conjunction with internal trading and exposure limits. In this regard, trading limits must be related to the Bank’s risk measurement model in a manner that is consistent over time and that it is well understood by both traders and Senior Management.
- 17. A Bank must include in its internal models risk factors deemed relevant for pricing. Any proxies used must show a good track record of the actual position held; for example, an equity index for a position in an individual stock.
Internal Validation
- 18. A Bank using models must provide for initial and on-going validation by a risk management function independent of the risk-taking functions of the internal model and when any significant changes are made to the model. More frequent validation is required where there have been significant structural changes in the market or changes to the composition of the portfolio which might lead to the model no longer being adequate.
- 19. A Bank’s model validation must not be limited to profit or loss attribution and back-testing, but, at a minimum, also must include tests to demonstrate that any assumptions made within the internal model are appropriate and do not underestimate risk. This may include normal distribution assumption, the use of the square root of time to scale from a one day holding period to a 10 day holding period or where extrapolation or interpolation techniques are used, or pricing models.
- 20. Testing for model validation must use hypothetical changes in portfolio value that would occur were end-of-day positions to remain unchanged. It therefore excludes fees, commissions, bid-ask spreads, net interest income and intra-day trading.
- 21. Additional tests are required, which may include but are not limited to:
- a. Testing carried out for longer than required for the regular back-testing program (for instance 3 years). The longer period generally improves the power of the back-testing. A longer time period may not be desirable if the model or market conditions have changed to the extent that historical data is no longer relevant;
- b. Testing carried out using confidence intervals in addition to the 97.5 percent and 99 percent interval required under the Basel quantitative standards;
- c. Testing of portfolios below the overall Bank level;
- d. The use of hypothetical portfolios to ensure that the model is able to account for particular structural features that may arise, for example, where data histories for a particular instrument do not meet the quantitative standards and where the Bank has to map these positions to proxies;
- e. Ensuring that material basis risks are adequately captured. This may include mismatches between long and short positions by maturity or by issuer; and
- f. Ensuring that the model captures concentration risk that may arise in an undiversified portfolio.
External Validation
- 22. The validation of the accuracy of a Bank’s models by an independent appropriately qualified specialist at a minimum (e.g. an external auditor) must include the following steps:
- a. Verifying that the internal validation processes are operating in a satisfactory manner;
- b. Ensuring that the formulae used in the calculation process as well as for the pricing of options and other complex instruments are validated by a qualified unit, which in all cases must be independent from the trading area;
- c. Checking that the structure of internal models is adequate with respect to the Bank’s activities and geographical coverage;
- d. Checking the results of the Bank’s back testing of its internal measurement system (for example, comparing model estimates with actual profits and losses) to ensure that the model provides a reliable measure of potential losses over time. A Bank must make the results as well as the underlying inputs to its model calculations available to the independent specialist; and
- e. Making sure that data flows and processes associated with the risk measurement system are transparent and accessible. In particular, it is necessary that the independent specialist has access as required to the model’s specifications and parameters.
- 22. The validation of the accuracy of a Bank’s models by an independent appropriately qualified specialist at a minimum (e.g. an external auditor) must include the following steps: