Finance Report: Analysis of Basel III Reforms and Operational Risks

This finance report provides a comprehensive analysis of the Basel III reforms, focusing on their impact on the banking industry and the management of operational risks. The report begins by outlining the primary motivations behind the implementation of Basel III, including the need to strengthen financial regulations, improve risk management, and promote economic stability in the wake of the 2008 financial crisis. It then delves into the key changes introduced by the reforms, such as the new definition of capital, the increased emphasis on common equity, and the three lines of defense approach to managing operational risks. The report also examines the specific challenges faced by banks in implementing Basel III, including balancing their interests with regulatory requirements, managing data, and adapting to national regulations. Furthermore, the report investigates the operational risks associated with technological advancements in banking, such as data breaches, IT disruptions, cyber fraud, and outsourcing. The report also discusses the role of the Australian Prudential Regulation Authority (APRA) in adopting and implementing the Basel III requirements, highlighting areas of divergence and the more conservative approach taken by APRA. The report concludes by comparing the Basel III guidelines with the previous Basel II guidelines, focusing on the methods for calculating minimum capital requirements for operational risk and emphasizing the challenges and complexities involved in effectively implementing the reforms. The report is a valuable resource for understanding the evolving landscape of financial regulation and the importance of risk management in the banking sector.

Running head: FINANCE
Finance
Name of the Student
Name of the University
Author Note

1
FINANCE
Table of Contents
Answer to Question 1...................................................................................................................2
Answer to Question 2...................................................................................................................6
Answer to Question 3...................................................................................................................7
Answer to Question 4...................................................................................................................9
Answer to Question 5.................................................................................................................12
References..................................................................................................................................18

2
FINANCE
Answer to Question 1
a) The main reason behind the implementation of the Basel III reforms was to develop a set
of financial regulations which strengthened the aspects of regulation, supervision and risk
management within the banking industry. The impact of the 2008 Global Financial Crisis
had severely weakened the bank’s ability to handle the shocks occurring from the
financial stresses. Another lesson learned from these reforms was that for growth to
continue along with the technological advances and innovation, a stable economic and
fiscal sector was also extremely necessary. The transparency and disclosure policies of
the banks had also become severely weakened prior to the introduction of these reforms
(Fratianni and Pattison 2015). Hence, the primary aim was to continue the steps
undertaken by the previous accords of Basel I and Basel II and strengthen the regulations
prevalent in the banking industry across the world. The purpose of strengthening the
regulations was to prevent banks from taking more risks than they can afford to and stop
them from hurting the economy of the country they are operating in. It also promoted
economic recovery and stability in the financial sector of different countries on which
these systems became applicable (Dermine 2015).
b) Operational risk is one of the most inherent risks faced by banks as a part of the business.
The new framework ensures that banks adopt the three line of defence as a part of
managing the operational risks faced by them. These include the business line
management, an independent corporate operational risk management function and an
independent review of the operations of the entity. One of the major changes to the
framework was the new definition of the term capital agreed in July 2010. It was agreed
that higher quality capital was one which had an increased loss-absorbing capacity and

3
FINANCE
allowed the banks to withstand longer periods of stress. One of the key changes is the
increased emphasis on common equity as the highest quality component of the bank’s
common capital. Any regulatory capital deductions are to be taken from the common
equity of the entity rather than the Tier 1 or Tier 2 capital owned by the bank. Hence,
banks can no longer display strong Tier 1 capital ratios with limited equity levels net of
the deductions. Apart from this, the senior management of the entity is charged with the
responsibility of identifying and assessing the operational risk inherent in all products,
materials and services provided by a business. All new products, processes and activities
of the bank should go through the approval process which fully assesses the operational
risk faced by the business (Cummings and Durrani 2016). A process should be
implemented by the management to regularly monitor the operational risk profiles of the
bank and the material exposure to losses. Reporting mechanisms should support the
proactive management of the operational risks thus identified. The public disclosures of a
bank should allow the stakeholders to assess the approach of a bank to the operational
risk management. A sufficient level of operational risk training should be provided to
employees at all levels in the organisation. The framework which is selected by a bank
for its operational risk management procedures should be a reflection of the nature, size,
complexity and risk profile of the bank. Another method of fully understanding the nature
and complexity of operational risk is to have all the components of the Basel III
Framework fully integrated into the risk management process of the organisation. The
results of the operational risk assessment of the bank’s performance should also be
incorporated into the overall bank business strategy development process. Every bank
should document the Basel III framework in the policies approved by the Board of

4
FINANCE
Directors and the definitions of operational risk and operational loss should be included
in the policies. The effectiveness of the framework would significantly decline without
appropriate measures taken by the banks to define both operational risk and operational
loss. The bank’s accepted risk appetite and tolerance and the threshold limits for the
inherent and residual risks should be clearly documented in the framework
documentation. The framework implemented as a part of the business should be regularly
reviewed and the operational risks associated with the changes in the operational policies
should be included in the framework (Cummings and Durrani 2018).
c) The Australian Prudential Regulation Authority (APRA) completed the adoption of the
Basel III requirements in November 2012 and brought them into action from 1 January
2013. After the adoption, the process adopted by the APRA was known as the assessment
work. This assessment work of APRA mainly consisted of three parts. The first phase is
known as the self-assessment by APRA. The second phase is called the off-and on-site
assessment phase and the third phase is known as the post-assessment review phase. The
off-and-on-site assessment phase is one of the most important phases of the procedures
undertaken by the APRA. It involved a travel to Sydney where the Assessment Team
held discussions with APRA, five internationally authorised deposit-taking institutions
(ADIs), two audit firms and a one credit rating agency of the business. The discussions
which took place gave an important overview and a better understanding about the
implementation of the Basel-based risk standards and their implementation in Australia.
The post-assessment review phase contained a thorough discussion on the review of the
findings of the review team and a technical review of the findings between various
boards. The Assessment team’s work and its interactions with APRA were controlled by

5
FINANCE
the Basel Committee Secretariat. Some of the aspects which were chosen to be
implemented by APRA include the definition of capital component as suggested by the
Basel Framework. One aspect where APRA chose to skip the recommendations of the
Basel Framework is in the implementation of the threshold deduction treatment, which is
a substantial increase in the conservatism within the rules of Basel III framework. Apart
from this, there are other areas of divergence in the manner of APRA’s approach to the
framework of Basel. The approach of APRA to the Australian Prudential Regime is much
more conservative than that of the Basel Framework. Hence, due to the regulations
implemented by APRA in its framework, any internationally active ADI operating within
Australia tends to face higher capital requirements. The capital requirements are almost
100 basis points higher than that of any other institutional institution subject to the
requirements of the Basel Framework worldwide (Atkin and Cheung 2017). The scope of
the approach consisted of two aspects which were followed in effectively implementing
the guidelines of the Basel Framework. The first aspect was the comparison of the capital
requirements under the Basel framework to ascertain if all the requirements under the
Basel Framework had been adopted. The second included the ascertainment of any
significant differences which existed between the domestic regulations and the Basel
Framework and their significance.
d) The main challenge faced by the banks when implementing the guidelines of Basel III is
to balance their interests with the requirements suggested by the regulator. The Basel III
is different from the previous regimes in the sense that it requires a greater integration
between the finance and risk management functions of a bank. However, in order to the
same, the main challenge is the differences in the people who are responsible for making

6
FINANCE
the decisions and those charged with management of risk. While Basel III is consistent in
the guidelines, the main challenge lies in the manner in which it is interpreted by the
banks belonging to different countries. The Basel II regulations were completely adopted
by some of the European banks while it was not adopted by the US banks. Hence,
completely adopting a new framework would be a significant challenge for the US banks
(Jones and Zeitz 2017). The national regulations prevailing in some of the countries may
make it difficult for a bank to adopt the Basel III regulations in the manner in which they
exist. Managing the data which reflects the bank’s credit, concentration and risk
management profiles all at the same time is another significant challenge. Stress testing
or understanding the impact of important market events on the key ratios of business also
takes a significant time from when they are initially implemented (Ahmed et al. 2015).
Answer to Question 2
One of the main operational risks which is faced by every bank due to the
implementation of technological advancements as a part of its business is the breach of the data
belonging to the customers and the employees. Cybersecurity is an increasingly worrying area in
banking and accounts for a significant amount of money spent by the banks in implementing the
information-technology based services. Data Theft, unauthorised access and employee
negligence all play a part in compromising the data of the consumers. Some of the examples of
recent times included the cyber-attack on the credit reporting agency Equifax. IT disruption is
the second operational risk faced by the banks implementing technology as a part of their
processes. A cyber-attack or issues arising from causes like human error or failure caused due to
aging hardware is enough to cause disruptions in the processes implemented by a bank. As it
happened in the WannaCry attack of 2017, the amounts spent on restoring the systems are way

7
FINANCE
higher than the payments made to the hackers themselves (Mohurle and Patil 2017). Any
vulnerability in the software of a bank provides an entry point to the users to the outer perimeters
of a bank and is a cause for concern. Cyber fraud undertaken by some of the people in the form
of phishing attacks like those which hit the Switzerland banks in 2017 are an important
operational risk faced by the businesses in the long run. A non-linear relationship between the
normal management of the company and the internal IT controls implemented by it results in the
occurrence of frauds which redirect payments from the banks and steal the funds available with
them. Outsourcing is another common phenomenon which occurs with the use of the
technological advancements of the business. Most of the banks in Australia have continued their
reliance on the vast networks of external vendors to help them increase the capacity of their
online platform management which helps them in grinding extra capacity. This results in
increasing the operational risks of compromising the data of the business and in disrupting the IT
environment of the business. Significant action may also be taken by the regulators to prevent the
use of outsourcing as a part of the business. Mis-Selling of financial products is another
operational risk faced by the businesses. The IT systems run on the basis of algorithmic software
which works on a set of predetermined set of instructions. The Royal Bank of Scotland was sued
by a Federal Housing Finance Agency for selling mortgage-backed securities to it (Zhang, Zhao
and Zhao 2015). The cost of settlement was as high as $5.5 billion. Hence, the technological
advancements may also mislead the business in certain scenarios.
Answer to Question 3
The Basel III guidelines replaces the previously existing Basel II guidelines in calculating
the minimum capital requirements for the operational risk faced by businesses. The Standardised
Approach adopted by the Basel III reforms replaces all the pre-existing methods of calculating

8
FINANCE
the minimum capital requirements for operational risk suggested by the guidelines of Basel II. In
the Basel-II guidelines, the approaches which were used in calculating the operational risk
capital included the Standardised Approach, the Basic Indicator Approach and the Advanced
Measurement Approaches. The Basic Indicator Approach suggested that the banks must hold
capital for operational risk which was equal to the average of the three year’s positive gross
income of the bank. Any negative gross income should be excluded from the calculation of the
average gross income for the past three years. In the Standardised Approach, the activities of the
bank are divided into eight business lines. These included corporate finance, trading &sales,
commercial banking, retail banking, agency services, asset management, payment & settlement
and retail brokerage. The minimum capital of the business is calculated on the basis of
multiplying the gross income of a business to a beta factor assigned to a particular business line
(Cecchetti 2016). The gross income, here, was only the total income of the business lines and not
the income of the institution as a whole. Under the Advanced Measurement Approaches, the
regulatory capital requirement will be equal to the risk measure generated by the internal
operational risk measurement system of the business. However, the usage of the Advanced
Measurement Approaches was based on the approval received from the regulatory supervisor
guiding the business. In the Basel III guidelines, the standardised approach is based on three
components. These are the Business Indicator, a financial-statement-based proxy, the Business
indicator component, a set of regulatory determined marginal coefficients and the Internal Loss
multiplier, a scaling factor based on previous losses. In case of the Australian banking
community, the APRA adopted more stringent measures than those suggested by the Basel
guidelines. In case of major banks like ANZ, National Australia Bank and Westpac, the
minimum capital was increased by the bank by an amount of $500 million each. This was done

9
FINANCE
to reflect the higher operational risk identified in their risk governance self-assessments. APRA
is also considering the implementation of an additional operating risk capital requirement on the
banks (Li et al. 2016) Due to the latest findings about the risk management procedures in the
various Australian banks and the risks faced by them, The recent measures and observations of
APRA suggests that there is an increasing need to strengthen the non-financial risk management
to ensure that the accountabilities of the business are clearly understood by all the banks.
Answer to Question 4
Risk
number
Risk description Control
number
(a) Control
description
(b)
Preventative/
Detective
control
(c) Basel
category
R1 Incomplete or inaccurate
information entered in IT
system from original
loan application.
C1 Peer review of
application
approval
process
performed by
team manager
Preventive Unauthorised
Activity

10
FINANCE
R2 Incomplete or inaccurate
information entered in IT
system by loan officer.
C2 Verification
process to
confirm whether
the approved
loan is within
the credit limits
of the
organisation
Detective Unauthorised
activity
R3 Client settlement
instructions are not
correct or are not
reflected accurately or
completely in the IT
system.
C3 Update the IT
settlement
system and
stamp and
submit a
hardcopy of the
application form
as suggested by
the delegated
authority.
Detective Systems

11
FINANCE
R4 Client/loan application
documentation is not
retained in accordance
with regulatory
requirements.
C4 Daily
reconciliation of
the records to
ensure that the
business does
not miss out on
any necessary
documents as
suggested by
the required
authorities.
Preventive Transaction
Capture,
Execution and
Maintenance
R5 Settlement amount is
inconsistent with the
loan approved; or
incorrect bank accounts
are affected during the
settlement process.
C5 Upgrade the IT
systems to
automatically
update the client
details and loan
balances as well
as the
drawdown
details
Detective Transaction
Capture,
Execution and
Maintenance

12
FINANCE
R6 Total settlement is not
consistent with the value
of the corresponding
loans approved/total
settlement expected/total
settlement recorded in
the GL.
C6 Daily
reconciliation
review process
including a
comparison of
the IT
settlement
system reports
and finance
control GL
reports
Detective Customer
Intake and
Documentatio
n
Answer to Question 5
a) One of the processes that is undertaken in my workplace is related to the marketing of
content on the basis of the requirements of the client. The process begins with the client
providing a keyword and ends with the outreach of the article by the marketing team. The
process which is usually followed as a part of the regular business procedures of the
client are documented in the flow chart mentioned below.

13
FINANCE
Keyword idea given to client
The writer creates a draft of the
article along with the images
The editor who gives their feedback on
the quality of the article reads the article
Designer creates the necessary
graphics
Marketer optimizes the article
and publishes it
The marketing team does
outreach
Approved
Disapproved
Keyword Rejected
Edits are required

14
FINANCE
b) The six key operational risks associated with the process identified above are as follows:
i. One of the primary operational risks is the lack of proper communication between the client
and the person responsible for dealing with the client. This may result in the loss of an order
which was supposed to be taken from the client and ultimately result in the loss of business.
ii. The next operational risk is the lack of sufficient tools available with the writer to create an
appropriate draft which can be used to forward to the editor. This may happen due to a lack of a
reliable system of internal control which identifies the requirements of the writer.
iii. The lack of sufficient number of writers due to the willingness of the business to keep its
costs low is an operational risk faced by the business. This may result in the entity missing out
on the business in the long run. Hence, understaffing is an operational risk for the business.
iv. The editor failing to proof read any of the articles due to misplacement of the same can be
considered to be a disastrous notion for the business. Hence, the misplacement of the articles
awaiting proofreading is a cause for concern for the business.
v. Proper coordination between all the processes of the business may result in the entity losing its
market in the long run. Hence, improper coordination is another cause for concern for the
business.
vi. Underutilisation of the marketing reach of the articles can be considered an extremely
difficult scenario for the business and hence needs to be overcome in order to mitigate the
operational risks faced by the business.
The tools that would be highly useful in identifying the risks and would be used as a part
of the process include Documentation reviews, Information gathering techniques, SWOT
Analysis, Interviewing and Root cause Analysis. The Documentation reviews are useful in

15
FINANCE
identifying the lessons learned from a particular project taken up in the past. It includes a
documentation of the past processes and the articles related to them amongst others. Information
gathering techniques are the ones used to collect requirements about a particular piece of the
business. Some of these techniques include brainstorming and Delphi Technique, Brainstorming
involves the discussions done with a group of people with the focus levied on identifying the risk
for a project. The Delphi technique involves a procedure in which a group of experts are
consulted anonymously by the business. The list of the required information is then sent to the
experts and the responses are compiled until a common consensus is reached amongst all the
parties. Interviewing is one of the most commonly used techniques in which the feedback is
taken from all the relevant parties and used as a part of designing the new processes which are to
be implemented at a later date. Root cause analysis involves a comprehensive analysis of the
risks initially identified by the business. This is useful in identifying the basic problems which
are the cause of the risks faced by the business.
c) The risk heat map is developed with the help of the following table in which risks are
ranked on the basis of their impact on the operations undertaken by a management.
Factor Rating
Lack of proper coordination in the
business
1
No Communication between client
and business
2
Understaffing 3
Improper internal control 4
Unavailability of resources 5

16
FINANCE
Lack of sufficient reach 6
0 1 2 3 4 5 6 7
0
1
2
3
4
5
6
7
Risk Heat Map
The coordination amongst all the processes of the businesses is essential for it to run
smoothly. However, it needs to be considered that the lack of coordination would result in
shutting down as a whole. Hence, due to the critical nature of coordination amongst all the
departments, it is essential to have a process that is well coordinated. Communicating with the
clients is necessary for the business to understand their requirements. Without which, the
business may not be able to retain them or grow. Hence, a proper communication channel is
necessary in mitigating the business risks. Sufficient number of staff are required to deliver a
project quickly. Understaffing would increase the burden on the single staff working by
themselves. It would slightly delay the process and put unnecessary burden on the existing
people. Hence, it is considered to be the fourth important factor. A proper balance of the
resources like computers, internet and software needs to be kept to ensure that the business runs
without much hurdles. The final product needs to properly reach to ensure the sustainability of

17
FINANCE
the business and in attracting new customers. However, this is not so severe when compared to
the other factors. Hence, it is ranked as the lowest.
d) Each of the risks can be commonly eliminated by an efficient system of internal control.
However, there are specific measures which need to be taken to overcome the individual
risks faced by the business. A common staff who are responsible for overseeing the
orders from the clients and passing it on to the writers are essential. Another staff would
be required to ensure that there is no order being missed from the proofreading process.
Forms should be maintained to ensure that the orders received from clients are not being
missed by the business. Similarly, additional employees need to be hired to ensure that
there is no understaffing and the business meets the requirements at all times. Proper
system of Information Technology should be maintained to ensure that the business does
not miss out on any orders or is unable to provide proper reach to the products.
e) A breakdown of the pandemic like coronavirus may completely slow down the business
and make it impossible for one to go to the office. In this case, the business needs to have
sufficient backup in place to ensure that the employees are able to work from home
without any interference. Due to the significance of the situation in the recent times, it is
not impractical to assume a scenario like this. Hence, it is considered as relevant.
f) Key Risk Indicators (KRIs) are useful in identifying the important risks faced by the
organisation and take steps in mitigating them. The types of KRIs include root risks, core
risks and operations risks. These are useful in identifying the common risks faced by a
business and in mitigating them without causing any damage to the business. The main
issues with the use of KRIs is that it is a continuous process and needs to be constantly
identified. It also involves the use of resources and time of the organisation.

18
FINANCE
ii) The lack of proper coordination is a root cause of harm to the business. Understaffing
and Internal control are also similarly important. Not mitigating these risks impacts the
business as a whole and hence these need to be overcome by the business.

19
FINANCE
References and Bibliography
Dermine, J., 2015. Basel III leverage ratio requirement and the probability of bank runs. Journal
of Banking & Finance, 53, pp.266-277.
Fratianni, M. and Pattison, J.C., 2015. Basel III in reality. Journal of Economic Integration, pp.1-
28.
Cummings, J.R. and Durrani, K.J., 2016. Effect of the Basel Accord capital requirements on the
loan-loss provisioning practices of Australian banks. Journal of Banking & Finance, 67, pp.23-
36.
Cummings, J.R. and Durrani, K.J., 2018. Regulatory capital and internal capital targets: An
examination of the Australian banking industry.
Atkin, T. and Cheung, B., 2017. How have Australian banks responded to tighter capital and
liquidity requirements?. RBA Bulletin, June, pp.41-50.
Jones, E. and Zeitz, A.O., 2017. The limits of globalizing Basel banking standards. Journal of
financial regulation, 3(1), pp.89-124.
Ahmed, S.U., Ahmed, S., Islam, M.D. and Ullah, G.M., 2015. Impact of Basel II implementation
on the financial performance of private commercial banks of Bangladesh. European Journal of
Economics, Finance and Administrative Sciences, (77).
Mohurle, S. and Patil, M., 2017. A brief study of wannacry threat: Ransomware attack
2017. International Journal of Advanced Research in Computer Science, 8(5).

20
FINANCE
Zhang, H.H., Zhao, F. and Zhao, X., 2015. Hiding behind writing: Communication in the
offering process of mortgage-backed securities. Unpublished manuscript. Retrieved
February, 25, p.2016.
Cecchetti, S.G., 2016. The jury is in. In The New International Financial System: Analyzing the
Cumulative Impact of Regulatory Reform (pp. 407-423).
Li, Y., Chen, Y.K., Chien, F.S., Lee, W.C. and Hsu, Y.C., 2016. Study of optimal capital
adequacy ratios. Journal of Productivity Analysis, 45(3), pp.261-274.
Torabi, S.A., Giahi, R. and Sahebjamnia, N., 2016. An enhanced risk assessment framework for
business continuity management systems. Safety science, 89, pp.201-218.