A new Australian risk-based framework

The above criticisms acted as triggers for change in APRA’s supervisory style. It moved away from a consultative and passive stance to a more interventionist and proactive supervisory style. It also realised that it was important to have skilled staff with the relevant training to deal with prudential supervision, especially those of high risk institutions. APRA thus adopted a single, integrated risk-based framework, having carefully considered the risk models of the US, Canada and the UK. The US uses a CAMELS risk framework, which

133 stands for Capital, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk. Each element is given a rating of 1-5 with 1 being the best. The average rating of the six elements is called the composite rating. Banks with an average rating of 5 are of greatest supervisory concern (Coleman 2008). The Supervisory Framework assesses inherent risks of significant activities carried out by banks in Canada. Inherent risks can be divided into six different types: credit risk; market risk; insurance risk; operational risk; regulatory compliance risk; and strategic risk. Each risk is given a level: low, moderate, above average, or high. The level of risk will then influence how much control and supervision the supervisor has over a bank (Office of the Superintendent of Financial Institutions 2010). The ARROW II risk framework in the UK is more detailed than the US or Canadian framework in that it divides risks into 52 elements and 10 risks groups. Each risk is given a level: low, medium low, medium high and high. Banks with medium high and high levels are visited regularly by the supervisor (Petch 2011).

APRA’s new risk-based supervisory model consists of PAIRS and SOARS. PAIRS stands for the Probability and Impact Ratings System and SOARS stands for the Supervisory Oversight and Response System. PAIRS and SOARS were influenced by the Canadian financial regulator, Office of the Superintendent of Financial Institutions (OSFI) and the UK financial regulator, the FSA Yet, APRA created its own risk-based model and there are three main differences between APRA’s model and the OSFI’s model. First, PAIRS is more radical than the Canadian model because the former goes further and links the concept of ‘overall risk of failure’ with APRA’s statutory objectives (Black 2004). Secondly, PAIRS produces an overall rating of risks by relying on a formal system of weighted risk assessments (Black 2004). Finally, influenced by the UK risk-based model, APRA incorporated the requirement of an impact assessment (Black 2004, Laker 2007). It considers the overall economic consequence if a regulated institution fails.

The overriding principle of PAIRS is to provide a rating for the likelihood of a regulated institution being unable to meet its financial obligations and the implications of the institutions’ failure on the overall economic system. The higher the rating, the more resources APRA needs to allocate to supervise the organisation. To arrive at a rating, the two-staged formula below is used:

Inherent risk – Management and control = Net Risk Net risk – Capital support = Overall risk of failure

134 Inherent risks are risks to an organisation’s financial position arising from the daily operation of the business. There are eight inherent risks: credit risk; balance sheet and market risk; insurance risk; operational risk; liquidity risk; legal and regulatory risk; strategic risk and contagion risk (Black 2004, Coleman 2008). These risks are assessed using a range of data collected from site visits; rating agencies; auditors’ reports and information from whistle- blowers. A rating of 0-4 is then given to inherent risks. The firm’s rating is then compared to other similar organisations in the same field. It is then weighted and aggregated to give an overall rating. An organisation’s management and controls are examined and rated to see how well they cope with inherent risks. There are six elements of management and control: operational management; the board of directors/trustees; senior management; management information systems/financial control; risk management; compliance and independent review. Each element is given a rating of 0-4, which is then compared to industry comparables. Again, each element is weighted and aggregated. Once the net risk is calculated, the organisation’s capital level is assessed. Capital acts as a buffer to externalities and absorbs financial losses. Weightings are given to three categories: 50% to current balance sheet amount and quality of capital; 25% to earnings strength and 25% to access to new capital (Black 2004, Australian Prudential Regulatory Authority 2013b).

The overall risk of failure is calculated using an exponential relationship between the risk score and probability rating. A risk rating of one leads to a probability rating of four that an organisation will fail. Similarly, a rating of four leads to a probability rating of 256 (44 = 256) that an organisation will fail. The exponential nature reflects the underlying philosophy of Australian prudential supervision since the magnifying effect of this exponential relationship highlights the urgency of the issue and a suitable supervisory response. This in turn leads to a more proactive and intrusive form of supervision, which was the recommendation of the HIH Royal Commission (HIH Royal Commission 2003) and the Palmer Report (Palmer 2002). The final stage of the risk assessment is to compare APRA’s rating with external reports from ratings agencies and media sources. An interesting element of PAIRS is the impact assessment, since this originates from the FSA in the UK. The impact assessment aims to measure the overall financial costs on the economic system if an organisation collapses. The assessment considers both direct costs to consumers and indirect costs due to systemic risks across the financial system (Black 2004). The impact is rated one of the following: extreme, high, medium or low. The impact assessment is important because it shapes the supervisory relationship with the organisation and the amount of resources that is required to supervise

135 the risks. A potential problem with risk-based regulation is that too much emphasis is paid to detecting the risks than rectifying them. The impact assessment is therefore crucial to link the diagnosis of the problem with the supervisory response.

SOARS constitutes a supervisory attention index and a supervisory stance. The index indicates how much resources an organisation needs to reduce the risks identified by PAIRS. The supervisory stance is APRA’s response to dealing with the overall risk of failure of an organisation and is divided into four levels: normal, oversight, mandated improvement and restructure. Organisations with a ‘normal’ SOARS stance require basic supervisory measures such as onsite visits and filing the requisite documents. An index of ‘oversight’ requires closer supervision by APRA. This involves more onsite visits, reporting requirements; independent auditors’ reports and possibly raising the capital level. Organisations with the index ‘mandated improvement’ will need to increase their capital level and respond with a specific list of actions within 90 days to APRA. The index label of ‘restructure’ is the most serious form of supervisory response. APRA will advise the organisation to merge or sell the business. It will also require the organisation to protect itself from further losses such as increasing its capital level or removing a member of senior management (Australian Prudential Regulatory Authority 2013b, Coleman 2008).

PAIRS and SOARS have improved the organisational and cultural dimensions of Australian prudential regulation and supervision. From an organisational perspective, PAIRS and SOARS provided a more coherent and unified risk-based model. Although SID and DID still co-exist, there is more consistency and better resource allocation. Resources are spent more on larger, high impact firms which are under the watchful eye of DID. PAIRS and SOARS involved staff from specialist units and enabled senior management to supervise staff, thus improving the internal culture and support systems. Supervisors had to develop new skills to understand and use PAIRS and SOARS. The regulatory and supervisory style has swung from a co-operative, passive approach to a more proactive and interventionist style. Officials at APRA are there to identify risks and provide solutions, not to sit back and be nice to the regulated organisations. Since PAIRS and SOARS have been implemented, APRA became more proactive, intervened earlier and the number of onsite visits increased by 20% (Black 2004, Parliament of Australia Department of Parliamentary Services 2005). The proactive supervisory style has led APRA to using a wider interpretation of its statutory powers under section 8 of the Australian Prudential Regulatory Authority Act 1998. In the HIH Royal Commission report, APRA submitted that it felt that it could only use its formal legal powers

136 unless an organisation is on the verge of financial failure. Since PAIRS and SOARS have been used, APRA has adopted a more robust and wider interpretation of statutes. A senior official of APRA said: ‘You could have a literal reading of the legislation that says unless it’s more likely than not that an institution will not be able to pay beneficiaries we can’t intervene, but that would be ridiculous—it’s the ultimate in javelin catching. We’ve moved from a 50-50 risk of failure to a 97%. I cannot really see someone taking us to court as to whether there has been a 50-50 risk or whether it can be lower’ (Black 2004). It has acted as a sword to a broader style of interpreting the law. Finally, the risk-based model of PAIRS and SOARS provide a useful shield to the criticisms against APRA for rogue trading in National Australia Bank in 2004. This incident led to a loss of around $360 million Australian dollars. APRA was able to defend its position by explaining that it used a consistent, logical risk- based model in deciding which organisations are high risks and therefore more resources were allocated to such organisations.