Finance Report: Analysis of Basel III Reforms and Operational Risks

This finance report provides a comprehensive analysis of the Basel III reforms, focusing on their impact on the banking industry and the management of operational risks. The report begins by outlining the primary motivations behind the implementation of Basel III, including the need to strengthen financial regulations, improve risk management, and promote economic stability in the wake of the 2008 financial crisis. It then delves into the key changes introduced by the reforms, such as the new definition of capital, the increased emphasis on common equity, and the three lines of defense approach to managing operational risks. The report also examines the specific challenges faced by banks in implementing Basel III, including balancing their interests with regulatory requirements, managing data, and adapting to national regulations. Furthermore, the report investigates the operational risks associated with technological advancements in banking, such as data breaches, IT disruptions, cyber fraud, and outsourcing. The report also discusses the role of the Australian Prudential Regulation Authority (APRA) in adopting and implementing the Basel III requirements, highlighting areas of divergence and the more conservative approach taken by APRA. The report concludes by comparing the Basel III guidelines with the previous Basel II guidelines, focusing on the methods for calculating minimum capital requirements for operational risk and emphasizing the challenges and complexities involved in effectively implementing the reforms. The report is a valuable resource for understanding the evolving landscape of financial regulation and the importance of risk management in the banking sector.

Running head: FINANCE
Finance
Name of the Student
Name of the University
Author Note

1
FINANCE
Table of Contents
Answer to Question 1...................................................................................................................2
Answer to Question 2...................................................................................................................6
Answer to Question 3...................................................................................................................7
Answer to Question 4...................................................................................................................9
Answer to Question 5.................................................................................................................12
References..................................................................................................................................18

2
FINANCE
Answer to Question 1
a) The main reason behind the implementation of the Basel III reforms was to develop a set
of financial regulations which strengthened the aspects of regulation, supervision and risk
management within the banking industry. The impact of the 2008 Global Financial Crisis
had severely weakened the bank’s ability to handle the shocks occurring from the
financial stresses. Another lesson learned from these reforms was that for growth to
continue along with the technological advances and innovation, a stable economic and
fiscal sector was also extremely necessary. The transparency and disclosure policies of
the banks had also become severely weakened prior to the introduction of these reforms
(Fratianni and Pattison 2015). Hence, the primary aim was to continue the steps
undertaken by the previous accords of Basel I and Basel II and strengthen the regulations
prevalent in the banking industry across the world. The purpose of strengthening the
regulations was to prevent banks from taking more risks than they can afford to and stop
them from hurting the economy of the country they are operating in. It also promoted
economic recovery and stability in the financial sector of different countries on which
these systems became applicable (Dermine 2015).
b) Operational risk is one of the most inherent risks faced by banks as a part of the business.
The new framework ensures that banks adopt the three line of defence as a part of
managing the operational risks faced by them. These include the business line
management, an independent corporate operational risk management function and an
independent review of the operations of the entity. One of the major changes to the
framework was the new definition of the term capital agreed in July 2010. It was agreed
that higher quality capital was one which had an increased loss-absorbing capacity and

3
FINANCE
allowed the banks to withstand longer periods of stress. One of the key changes is the
increased emphasis on common equity as the highest quality component of the bank’s
common capital. Any regulatory capital deductions are to be taken from the common
equity of the entity rather than the Tier 1 or Tier 2 capital owned by the bank. Hence,
banks can no longer display strong Tier 1 capital ratios with limited equity levels net of
the deductions. Apart from this, the senior management of the entity is charged with the
responsibility of identifying and assessing the operational risk inherent in all products,
materials and services provided by a business. All new products, processes and activities
of the bank should go through the approval process which fully assesses the operational
risk faced by the business (Cummings and Durrani 2016). A process should be
implemented by the management to regularly monitor the operational risk profiles of the
bank and the material exposure to losses. Reporting mechanisms should support the
proactive management of the operational risks thus identified. The public disclosures of a
bank should allow the stakeholders to assess the approach of a bank to the operational
risk management. A sufficient level of operational risk training should be provided to
employees at all levels in the organisation. The framework which is selected by a bank
for its operational risk management procedures should be a reflection of the nature, size,
complexity and risk profile of the bank. Another method of fully understanding the nature
and complexity of operational risk is to have all the components of the Basel III
Framework fully integrated into the risk management process of the organisation. The
results of the operational risk assessment of the bank’s performance should also be
incorporated into the overall bank business strategy development process. Every bank
should document the Basel III framework in the policies approved by the Board of

4
FINANCE
Directors and the definitions of operational risk and operational loss should be included
in the policies. The effectiveness of the framework would significantly decline without
appropriate measures taken by the banks to define both operational risk and operational
loss. The bank’s accepted risk appetite and tolerance and the threshold limits for the
inherent and residual risks should be clearly documented in the framework
documentation. The framework implemented as a part of the business should be regularly
reviewed and the operational risks associated with the changes in the operational policies
should be included in the framework (Cummings and Durrani 2018).
c) The Australian Prudential Regulation Authority (APRA) completed the adoption of the
Basel III requirements in November 2012 and brought them into action from 1 January
2013. After the adoption, the process adopted by the APRA was known as the assessment
work. This assessment work of APRA mainly consisted of three parts. The first phase is
known as the self-assessment by APRA. The second phase is called the off-and on-site
assessment phase and the third phase is known as the post-assessment review phase. The
off-and-on-site assessment phase is one of the most important phases of the procedures
undertaken by the APRA. It involved a travel to Sydney where the Assessment Team
held discussions with APRA, five internationally authorised deposit-taking institutions
(ADIs), two audit firms and a one credit rating agency of the business. The discussions
which took place gave an important overview and a better understanding about the
implementation of the Basel-based risk standards and their implementation in Australia.
The post-assessment review phase contained a thorough discussion on the review of the
findings of the review team and a technical review of the findings between various
boards. The Assessment team’s work and its interactions with APRA were controlled by

5
FINANCE
the Basel Committee Secretariat. Some of the aspects which were chosen to be
implemented by APRA include the definition of capital component as suggested by the
Basel Framework. One aspect where APRA chose to skip the recommendations of the
Basel Framework is in the implementation of the threshold deduction treatment, which is
a substantial increase in the conservatism within the rules of Basel III framework. Apart
from this, there are other areas of divergence in the manner of APRA’s approach to the
framework of Basel. The approach of APRA to the Australian Prudential Regime is much
more conservative than that of the Basel Framework. Hence, due to the regulations
implemented by APRA in its framework, any internationally active ADI operating within
Australia tends to face higher capital requirements. The capital requirements are almost
100 basis points higher than that of any other institutional institution subject to the
requirements of the Basel Framework worldwide (Atkin and Cheung 2017). The scope of
the approach consisted of two aspects which were followed in effectively implementing
the guidelines of the Basel Framework. The first aspect was the comparison of the capital
requirements under the Basel framework to ascertain if all the requirements under the
Basel Framework had been adopted. The second included the ascertainment of any
significant differences which existed between the domestic regulations and the Basel
Framework and their significance.
d) The main challenge faced by the banks when implementing the guidelines of Basel III is
to balance their interests with the requirements suggested by the regulator. The Basel III
is different from the previous regimes in the sense that it requires a greater integration
between the finance and risk management functions of a bank. However, in order to the
same, the main challenge is the differences in the people who are responsible for making

6
FINANCE
the decisions and those charged with management of risk. While Basel III is consistent in
the guidelines, the main challenge lies in the manner in which it is interpreted by the
banks belonging to different countries. The Basel II regulations were completely adopted
by some of the European banks while it was not adopted by the US banks. Hence,
completely adopting a new framework would be a significant challenge for the US banks
(Jones and Zeitz 2017). The national regulations prevailing in some of the countries may
make it difficult for a bank to adopt the Basel III regulations in the manner in which they
exist. Managing the data which reflects the bank’s credit, concentration and risk
management profiles all at the same time is another significant challenge. Stress testing
or understanding the impact of important market events on the key ratios of business also
takes a significant time from when they are initially implemented (Ahmed et al. 2015).
Answer to Question 2
One of the main operational risks which is faced by every bank due to the
implementation of technological advancements as a part of its business is the breach of the data
belonging to the customers and the employees. Cybersecurity is an increasingly worrying area in
banking and accounts for a significant amount of money spent by the banks in implementing the
information-technology based services. Data Theft, unauthorised access and employee
negligence all play a part in compromising the data of the consumers. Some of the examples of
recent times included the cyber-attack on the credit reporting agency Equifax. IT disruption is
the second operational risk faced by the banks implementing technology as a part of their
processes. A cyber-attack or issues arising from causes like human error or failure caused due to
aging hardware is enough to cause disruptions in the processes implemented by a bank. As it
happened in the WannaCry attack of 2017, the amounts spent on restoring the systems are way

7
FINANCE
higher than the payments made to the hackers themselves (Mohurle and Patil 2017). Any
vulnerability in the software of a bank provides an entry point to the users to the outer perimeters
of a bank and is a cause for concern. Cyber fraud undertaken by some of the people in the form
of phishing attacks like those which hit the Switzerland banks in 2017 are an important
operational risk faced by the businesses in the long run. A non-linear relationship between the
normal management of the company and the internal IT controls implemented by it results in the
occurrence of frauds which redirect payments from the banks and steal the funds available with
them. Outsourcing is another common phenomenon which occurs with the use of the
technological advancements of the business. Most of the banks in Australia have continued their
reliance on the vast networks of external vendors to help them increase the capacity of their
online platform management which helps them in grinding extra capacity. This results in
increasing the operational risks of compromising the data of the business and in disrupting the IT
environment of the business. Significant action may also be taken by the regulators to prevent the
use of outsourcing as a part of the business. Mis-Selling of financial products is another
operational risk faced by the businesses. The IT systems run on the basis of algorithmic software
which works on a set of predetermined set of instructions. The Royal Bank of Scotland was sued
by a Federal Housing Finance Agency for selling mortgage-backed securities to it (Zhang, Zhao
and Zhao 2015). The cost of settlement was as high as $5.5 billion. Hence, the technological
advancements may also mislead the business in certain scenarios.
Answer to Question 3
The Basel III guidelines replaces the previously existing Basel II guidelines in calculating
the minimum capital requirements for the operational risk faced by businesses. The Standardised
Approach adopted by the Basel III reforms replaces all the pre-existing methods of calculating

8
FINANCE
the minimum capital requirements for operational risk suggested by the guidelines of Basel II. In
the Basel-II guidelines, the approaches which were used in calculating the operational risk
capital included the Standardised Approach, the Basic Indicator Approach and the Advanced
Measurement Approaches. The Basic Indicator Approach suggested that the banks must hold
capital for operational risk which was equal to the average of the three year’s positive gross
income of the bank. Any negative gross income should be excluded from the calculation of the
average gross income for the past three years. In the Standardised Approach, the activities of the
bank are divided into eight business lines. These included corporate finance, trading &sales,
commercial banking, retail banking, agency services, asset management, payment & settlement
and retail brokerage. The minimum capital of the business is calculated on the basis of
multiplying the gross income of a business to a beta factor assigned to a particular business line
(Cecchetti 2016). The gross income, here, was only the total income of the business lines and not
the income of the institution as a whole. Under the Advanced Measurement Approaches, the
regulatory capital requirement will be equal to the risk measure generated by the internal
operational risk measurement system of the business. However, the usage of the Advanced
Measurement Approaches was based on the approval received from the regulatory supervisor
guiding the business. In the Basel III guidelines, the standardised approach is based on three
components. These are the Business Indicator, a financial-statement-based proxy, the Business
indicator component, a set of regulatory determined marginal coefficients and the Internal Loss
multiplier, a scaling factor based on previous losses. In case of the Australian banking
community, the APRA adopted more stringent measures than those suggested by the Basel
guidelines. In case of major banks like ANZ, National Australia Bank and Westpac, the
minimum capital was increased by the bank by an amount of $500 million each. This was done

9
FINANCE
to reflect the higher operational risk identified in their risk governance self-assessments. APRA
is also considering the implementation of an additional operating risk capital requirement on the
banks (Li et al. 2016) Due to the latest findings about the risk management procedures in the
various Australian banks and the risks faced by them, The recent measures and observations of
APRA suggests that there is an increasing need to strengthen the non-financial risk management
to ensure that the accountabilities of the business are clearly understood by all the banks.
Answer to Question 4
Risk
number
Risk description Control
number
(a) Control
description
(b)
Preventative/
Detective
control
(c) Basel
category
R1 Incomplete or inaccurate
information entered in IT
system from original
loan application.
C1 Peer review of
application
approval
process
performed by
team manager
Preventive Unauthorised
Activity

10
FINANCE
R2 Incomplete or inaccurate
information entered in IT
system by loan officer.
C2 Verification
process to
confirm whether
the approved
loan is within
the credit limits
of the
organisation
Detective Unauthorised
activity
R3 Client settlement
instructions are not
correct or are not
reflected accurately or
completely in the IT
system.
C3 Update the IT
settlement
system and
stamp and
submit a
hardcopy of the
application form
as suggested by
the delegated
authority.
Detective Systems

11
FINANCE
R4 Client/loan application
documentation is not
retained in accordance
with regulatory
requirements.
C4 Daily
reconciliation of
the records to
ensure that the
business does
not miss out on
any necessary
documents as
suggested by
the required
authorities.
Preventive Transaction
Capture,
Execution and
Maintenance
R5 Settlement amount is
inconsistent with the
loan approved; or
incorrect bank accounts
are affected during the
settlement process.
C5 Upgrade the IT
systems to
automatically
update the client
details and loan
balances as well
as the
drawdown
details
Detective Transaction
Capture,
Execution and
Maintenance