<<

N O R T H E R N T R U S T

The Evolution of US II Operational Advanced Measurement Approach‡ October 17, 2012 Moody's Analytics Risk Practitioner Conference Chicago, IL

Alexander Cavallo Vice President and Risk Specialist Corporate Risk Analytics and Insurance [email protected]

‡ The views expressed in this presentation are the views of the author and do not necessarily reflect the opinions of Northern Trust Corporation.

© 2012, Northern Trust Corporation. All Rights Reserved. Agenda

I. and the Basel II Advanced Measurement Approach (AMA) II. Implementing the AMA in practice III. Factors that influence operational risk IV. Maneuvering through the regulatory landscape V. About Northern Trust

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 2 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Northern Trust: A Highly Focused Business Model

Founded in 1889, Northern Trust Corporation is a global leader in asset servicing, asset management, wealth management and banking for personal and institutional clients.

Personal Financial Services Leading advisor to affluent market  AUM $176 Billion  AUC $411 Billion

Corporate & Institutional Services Leading global custodian Pension funds Individuals  AUC $4.2 Trillion Fund managers Families  AUM $528 Billion Insurance Family offices Foundations Family foundations Endowments & endowments Northern Trust Global Investments Sovereign Privately held Leading asset manager for wealth funds businesses personal & institutional clients  AUM $704 Billion

Operations & Technology Integrated global operating platform  Serving personal and institutional clients  $1.6 Billion in technology spending 2009-2011

As of June 30, 2012

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 3 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. I. Operational risk and the Basel II Advanced Measurement Approach (AMA)

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 4 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. The Basel II Accord establishes comprehensive international standards for regulation and supervision of

 Objectives of the Basel II Accord  Incorporate risk measurement and advances into capital requirements  Develop risk‐sensitive capital requirements to ensure an adequate capital cushion to absorb financial losses at large complex financial banks using rigorous approaches  The Basel II Accord establishes “Three Pillars” for accomplishing these objectives  Pillar 1 – Minimum Capital Requirements Establishes a method for calculating minimum regulatory capital by maintaining existing approaches for and setting new requirements for assessing and a new risk class, operational risk  Pillar 2 – Supervisory Review Process Requires banks to have an internal capital assessment process and banking supervisors to evaluate each ’s overall risk profile as well as its risk management and internal control processes  Pillar 3 –Market Discipline Improves transparency and strengthens market discipline by establishing minimum disclosure requirements for banks regarding the composition and structure of the bank’s capital, the nature of its risk exposures, its risk management and internal control processes, and its capital adequacy

Using the Advanced Measurement Approach (AMA) for operational risk quantification, banks have flexibility to develop a customized risk measurement system that reflects each bank’s unique risk profile

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 5 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Operational Risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events  Operational Risk is the potential that inadequate information systems, operating problems, product design and delivery difficulties, or catastrophes will result in unexpected losses  Includes Legal, Compliance and Fiduciary  Excludes Strategic and Reputational Risks  For the first time, the Basel II Accord requires banks to quantify operational risk exposure and estimate capital requirements  Operational risk is a focus of regulatory supervision because a single catastrophic loss can threaten the solvency of a bank  Some illustrative examples of operational loss events: Market manipulation –a $6.7 billion trading loss Ponzi scheme –a $2.1 billion internal fraud Amaranth Advisors announced on September 18, 2006 that Shortly after the arrest of Bernard Madoff in New York City in it had suffered losses greater than $3 billion from natural gas mid‐December 2008, Bank Medici AG, based in Vienna, trades. The losses were attributed to a dramatic drop in announced that it had $2.1 billion invested with Bernard L. natural gas prices during the month of September 2006 and Madoff Investment Securities (BLMIS). Investigations into an associated lack of liquidity in the market … The reported Bank Medici and its founder Sonja Kohn were undertaken in losses increased to $6 billion by September 21, 2006 as a Austria, the US and UK. Investigators in the London and New result of the sale of certain assets at fire sale prices. York discovered suspicious payments made to Kohn by Madoff. Unauthorized activity –a $1.8 billion internal fraud CITIC Pacific Limited, a major investment company Model error –a $242 million loss with fines headquartered in Hong Kong, disclosed on October 20, 2008 On April 15, 2010, AXA Rosenberg Group LLC, a that it had incurred mark‐to‐market losses of HKD $14.7 quantitative money management firm, disclosed to billion (USD $1.8 billion) due to foreign exchange forward contracts that an executive director entered into without clients a coding error in its computer‐driven proper authorization between July 2007 and September investment process. 2008. The Evolution of US Basel II Operational Risk Advanced Measurement Approach 6 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. The Basel II Accord prescribes a standardized taxonomy with multiple levels of Event Type  Internal Fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/discrimination events, which involves at least one internal party  Unauthorized Activity  Theft and Fraud  External Fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party  Theft and Fraud  Systems Security  Employment Practices and Workplace Safety: Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events  Employee Relations  Employee Diversity & Discrimination  Safe Work Environment  Clients, Products & Business Practices: Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product.  Suitability, Disclosure & Fiduciary  Selection, Sponsorship & Exposure  Improper Business or Market Practices  Advisory Activities  Product Flaws  Damage to Physical Assets: Losses arising from loss or damage to physical assets from natural disaster or other events.  Disasters and other events  Business Disruption and System Failures: Losses arising from disruption of business or system failures  Systems  Execution, Delivery & Process Management: Losses from failed transaction processing or process management, from relations with trade counterparties and vendors  Transaction Capture, Execution & Maintenance  Trade Counterparties  Monitoring and Reporting  Vendors & Suppliers  Customer Intake and Documentation Note: The seven Level 1 categories for Basel Event Type are shown above, along with Level 2 subcategories. The Evolution of US Basel II Operational Risk Advanced Measurement Approach 7 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Standardized business line categories are established by the Basel II Accord, but most bank loss event databases have additional fields Basel II Business Line Categories  Agency Services  Commercial Banking  Payment/Settlement  Trading & Sales  Custody  Commercial  External Clients  Sales  Corporate Agency Banking  Retail Banking  Market Making  Corporate Trust  Corporate Finance  Retail Banking  Proprietary  Asset Management  Corporate Finance  Private Banking Positions  Discretionary Fund  Municipal & Govt.  Card Services  Treasury Management Finance  Retail Brokerage  Non‐Discretionary  Merchant Banking  Retail Brokerage Fund Management  Advisory Services Note: The eight Level 1 categories for Basel Business Line are shown above, along with Level 2 subcategories. Typical Data Fields in a Loss Event Database  Basel II Fields Recognition Date  Specific Product  Client Account(s)  Reference Date  Discovery Date  Institutional Detail Affected  Basel Event Type  Event Begin Date  Legal Entity  Risk Management  Basel Business Line  Event End Date  Business Unit Information  Gross Loss Amount  Event Characteristics  Division  Process Identifier  Net Loss Amount  Event Description  etc.  Contributing  Date Fields  Geographic  Client Information Factor(s)  Financial Identifiers  Client Segment  Preventative  Product Line/Class Action(s)

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 8 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. The US regulations that implement the Basel II Accord (the “Final Rule”) establish very general requirements for AMA models

 The regulatory for Aggregate Annual Loss Distribution operational is based on the at the Regulatory Capital 99.9th percentile of the distribution of potential (99.9th percentile) aggregate operational losses over a 1 year time horizon Expected  This corresponds to the total annual loss that would Operational Loss (Mean) be exceed less frequently than once in 1,000 years

 Within the AMA framework for operational risk, Total Annual Loss Amount ($) banks must incorporate four disparate data elements on an ongoing basis Challenges in AMA Implementation:  Internal Loss Data  Scenario Analysis (SA) 1. The Final Rule It is not prescriptive on (ILD)  Business Environment how to use the required data  External Loss Data and Internal Control elements (ELD) Factors (BEICFs) 2. The four key descriptors of the modeling processes are not defined  Moreover, the US “Final Rule” requires that bank’s processes for incorporating the required 3. Arriving at a reasonable estimate is data elements are not an exercise of straightforward  Credible  Systematic calculations, but includes well‐  Transparent  Verifiable documented and justified exercise of judgment

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 9 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Historical loss data is a core component of most AMA frameworks and capital models Internal Loss Data (ILD) External Loss Data (ELD)  Banks record their own operational loss  External loss data sources for operational events in a database loss modeling  A minimum observation period of at least  Data consortia who distribute anonymized five years is required, although short loss data from member submissions (such periods may be approved by the regulatory as ORX or the ABA) supervisor(s)  Vended databases based on publicly  A bank must be able to map ILD into the known operational loss events (such as seven Basel Loss Event Type categories Algorithmics FIRST or SAS OpRisk Global)  Typically, the full spectrum of information  Loss event data is available only for losses is gathered only for losses above a certain above a data collection threshold data collection threshold established by established by the consortium or vendor the bank  Challenges  Challenges  Data must be filtered to reflect losses that  Most institutions have limited experience may be relevant to the bank, but due to of the severe operational losses that drive anonymity of loss data, consortium capital requirements (i.e. right tail events) databases cannot be filtered at the  To obtain useable sample sizes, a bank institution level to select losses from the must typically group internal losses that most comparable banks exhibit many important differences (eg.  Some question the relevance of external time period, geography, business line, data given important differences in risk product, etc.) appetite, internal controls, and culture across institutions The Evolution of US Basel II Operational Risk Advanced Measurement Approach 10 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Scenario analysis and Business Environment/Internal Control Factors (BEICFs) help account for an institution’s unique risk profile Business Environment/Internal Scenario Analysis (SA) Control Factors (BEICFs)  According to the Final Rule, scenario  The Final Rule describes BEICFs as analysis  Indicators of a bank’s operational risk profile  Is the systematic process of obtaining expert that reflect a current and forward‐looking opinions from business managers and risk assessment of the underlying business risk management experts to derive reasoned factors and internal control environment assessments of the likelihood and loss impact  Examples: of plausible high severity operational losses Business Environment: Employee turnover rate, staffing levels, etc.  May include the well‐reasoned evaluation Internal Control Factors: Number of open and use of external operational loss event Audit issues, Risk Control Self‐Assessment data, adjusted as appropriate to ensure (RCSA) scores, etc. relevance to a bank’s operational risk profile  Challenges and control structure  Gathering BEICFs over a sufficiently long  Challenges historical period to permit modeling  The credibility of statistical techniques to  Changes in definition of factors can reduce combine SA with ILD and/or ELD is still under usefulness of available information debate among US regulatory agencies  The most effective use BEICFs in modeling is  SA programs designed for risk management still undetermined –many institutions use a can be hard to use for quantification qualitative review of BEICFs to support a post‐  SA programs designed for quantification modeling adjustment typically yield limited risk management value

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 11 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. II. Implementing the AMA in practice

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 12 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Most implementations of the Advanced Measurement Approach break the task into distinct components 1. Unit of Measure Definition 1. Segment historical loss data into 1.00 0.80 Function Historical Losses units of measure (homogeneous 0.60 LOSS LOSS LOSS DATE 0.40 Probability groups of losses sharing common ID AMOUNT XYZ MM/DD/YYYY $100,000 0.20 ABC MM/DD/YYYY $200,000 0.00

characteristics and statistical Cumulative $10 $100 $1,000 $10,000 etc. etc. etc. Loss Amount Thousands properties) Group 1 Group 2 Group 3 Group 4 Group 5 Group 6 2. Unit of Measure Level 2. For each unit of measure, estimate A. A frequency model describing A. Frequency Monte Carlo simulation, Distribution Panjer recursion, or the distribution of the number Convolution (FFT) of loss events occurring in a year B. A severity model for the C. Aggregate # of loss events per year Annual Loss distribution of loss severity Distribution C. The distribution of total losses B. Severity Distribution for the year (the aggregate annual loss distribution)

3. Generate the enterprise level 1.00 $ value of loss event aggregate annual loss distribution 0.80

by combining the unit of measure 0.60 3. Enterprise Aggregate 0.40 Undiversified level aggregate annual loss Density Annual Loss Distribution Diversified distributions, accounting for less 0.20

0.00 than perfect dependence 10 100 1,000 10,000 Aggregate Losses ($ Millions)

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 13 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. There is a wide range of practice in how banks define units of measure but a general consensus with respect to frequency modeling Unit of Measure Definition Frequency Modeling

 The Final Rule requires that a unit of measure  A count distribution such as Poisson,  Should reflect the bank’s range of business activities Negative Binominal, or Zero‐Inflated and the variety of operational losses which can Poisson are typical frequency models occur  The estimation sample or approach  Cannot combine business activities or operational should consider possible changes in loss events with demonstrably different risk profiles loss frequency due to changes in bank  Most institutions begin unit of measure structure (acquisitions or diverstitures) definition with the Basel II event type and/or and strategy (business expansion or business lines as starting point reduction)  7 event type level 1 categories   8 business line level 1 categories Most banks use simple Maximum  56 level 1 event type by business line cells Likelihood Estimators for the frequency  These initial groupings are refined if they fail to models have sufficiently “well behaved” distributions  Some institutions incorporate BEICFs as  Groupings can be grouped to a more aggregated explanatory variables in a regression level or further split out type approach  This can be particularly helpful for  Considerations meeting the Bank’s  Minimum sample size/precision desired expectations for stress testing for the  Integration with internal business needs may dictate alternative starting points (eg. business unit, Comprehensive Capital Adequacy legal entity, etc.) Review (CCAR) or Capital Plan Review (CaPR) The Evolution of US Basel II Operational Risk Advanced Measurement Approach 14 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Determining appropriate severity models for each unit of measure is the greatest empirical challenge in modeling operational risk

 Estimation of severity models is fundamentally challenged by  Data paucity –limited availability of operational loss data generally, and especially for the low‐ frequency high‐severity events that drive capital estimates  Parameter instability –heavy‐tailed loss distributions appropriate for operational risk are unstable and can be extremely sensitive to individual data points  Heterogeneity – obtaining have reasonably sized estimation samples requires the pooling of losses arising from many different business processes, time periods, geographies, etc. Attempts to increase sample size within a unit of measure necessarily require including more dissimilar loss events  Left truncation –in the presence of a data collection threshold, US regulators generally require the estimation of truncated distributions, exacerbating sensitivity to individual data points  Data instability –because operational loss databases evolve over time, changes to individual loss data points are common and can result in surprising changes to capital estimates  Modeling approaches  Single parametric distribution fit to all losses above data collection threshold  Mixture models in which losses arise from a small number of distinct but overlapping component distributions  Spliced distributions (body‐tail approach) –the distribution changes shape at a certain point  US regulators expect banks to justify the selection of the modeling approach  What is the underlying business rationale or theoretical justification for the assumed model?  Mixing proportions and splice points should be endogenously determined  An Extreme Value Theory argument can only justify a spliced distribution approach with an EVT distribution for the tail The Evolution of US Basel II Operational Risk Advanced Measurement Approach 15 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. The Final Rule permits each bank to determine the most appropriate way to use the required data elements in its capital quantification system

 The June 2011 Interagency Guidance suggests the use of benchmarking approaches to incorporate additional data elements  When using a benchmarking approach, apparent differences between the core model and the benchmark model must be reconciled and justified result in some subsequent action (such as revision of capital estimate, modification of benchmark, etc.)  Some institutions use model averaging approaches or other statistical arguments to combine core and benchmark models  Some configurations of core and benchmark models  Core model –ILD only  Benchmark model –ILD only  Core model –ELD only  Benchmark model –ELD only  Core model –SA only  Benchmark model –SA only  Core model – Pool ILD and ELD

 The core model may modified with post‐modeling adjustments to incorporate  BEICFs  SA

 A few statistical models exist to combine historical data and scenarios, but require extensive justification to survive regulatory review  Dutta and Babbel (2010) “Change of measure approach”  Egrashev (2011) “Worst case scenarios”  Cope (2012) “Super‐position of scenario‐based loss processes”

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 16 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Standard practices have emerged for generating aggregate annual loss distributions, but aggregation to the enterprise level is still in debate

 A number of methods can be used to build the aggregate annual loss distribution its frequency and severity components  Monte Carlo simulation  Panjer recursion  Numerical convolution (Fast Fourier Theorem)  Analytic approximations such as the single‐loss approximation

 Under the Final Rule, the default assumption for aggregating unit of measure risks is to assume perfect dependence  Banks can claim a diversification benefit if they can demonstrate to the regulatory supervisors sufficient evidence of less than perfect dependence of risks across units of measure  US regulators have largely ruled out the acceptance of any diversification benefit that fails to display “upper tail dependence” – increased probability of co‐occuring severe losses across units of measure

 Developing sufficiently credible empirical evidence to support diversification claims is challenging due to  Limited loss history  The need to make inferences about dependence on an annual basis using models calibrated to quarterly or monthly data

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 17 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. III. Factors that influence operational risk

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 18 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Of the factors affecting operational risk, there is most insight into factors that affect loss frequency  There is some literature to suggest that the loss frequency component of operational risk changes over time  Across the industry, the frequency of large rogue trading events seems to increase during times of market volatility  For business lines that involve asset movements or reallocations, the frequency of operational loss events may increase during times of increased transaction volume  Across the industry, there is clear evidence of a systematic increase in loss frequency related to accounting periods (Q4 or H2 of bank fiscal years)  The loss frequency process for particular unit of measure at a bank may change due to changes at the bank itself –for example  Loss frequency may increase as the result of an acquisition or may decrease following a divestiture  Enhancements to the internal data collection program and policy may result in more diligent recording of operational loss events  Changes in business strategy to take on or reduce business volume may result in changes in loss frequency  As part of the Federal Reserve Bank’s annual Comprehensive Capital Adequacy Review (CCAR) and Capital Plan Review (CaPR), the industry is investigating the potential link between macroeconomic factors and operational loss frequency By developing a more transparent linkage between operational loss frequency and underlying risk drivers, banks can deliver actionable information to business line management

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 19 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. There is also a growing literature about systematic factors the explain differences in operational loss severity  Wei (2007) finds operational loss severity is larger for larger banks (measured by assets)  Cope et al (2012) find that a number country characteristics such as origin of legal system, investor protections, GDP growth, etc. affect the severity of operational losses  It is widely known that loss events in the Clients, Products & Business Practices Basel Event Type represent a substantial fraction of total industry operational risk loss amounts and capital requirements  There are important systematic differences in severity within this event type by country, specifically, losses in some countries in North America are much more severe due to the availability of class action litigation  It also stands to reason that client and products characteristics may explain important differences in loss severity within a unit of measure

Some institutions are attempting to incorporate product and/or client characteristics into severity models to identify underlying risk drivers and plan appropriate changes to products, policies, and/or procedures

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 20 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. IV. Maneuvering through the regulatory landscape

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 21 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Strategies for successful AMA implementations: Suggestion #1: Turn operational risk into a value added proposition

 The existing paradigm in operational risk, the loss distribution approach with MLE‐based severity estimation, links operational risk capital to underlying drivers of risk in a way that generates limited actionable information for business decision makers to use in managing the business  In general, operational risk practitioners have found far from satisfactory most of the answers to the question “Why did capital change?”  Most often, explanations of capital change are linked to changes in model parameters for frequency and/or severity but not to a specific reason or cause for the change Set out to deliverable actionable business information to business line management by finding ways to incorporate important economic content and business consideration into the AMA framework  Engage business line management to see how the AMA model can best be integrated with the actual organizational structure of the bank  What factors should be considered in defining units of measure: business units, business lines, event types, geography, etc.?  What are the levers that businesses can use to change operational risk going forward? Do these affect frequency, severity, or both?  Leverage the AMA framework to deliver usable information  Analysis of hypothetical loss data can suggest likely capital impacts of a potential acquisition  Detailed analysis of ILD by can suggest specific products and/or processes for possible redesign

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 22 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Strategies for successful AMA implementations: Suggestion #2: Don’t reinvent the wheel –create and share knowledge

 After more than 10 years of active research in operational risk, many questions are unanswered and challenges remain Build off of the work of the practitioners, researchers, and institutions who have worked on operational risk before your institution

 Read the existing literature with a critical eye  Just because a paper or result is published does not mean that it is correct or even applicable to your institution  Do not constrain your thinking by limiting to scope of literature to read – catastrophic tail events occur in many disciplines outside of banking  Contact authors to discuss questions when your team is well prepared –most authors are happy to talk about their research and opinions  Develop a strong professional network of operational risk practitioners  Discussions with experienced operational risk teams can save your institution from months of frustrating work that leads to a dead end  Information sharing across institutions helps identify emerging trends in regulatory concerns on important operational risk topics  Support the professional development of your operational risk team  Encourage quants and non‐quants to become involved in relevant industry groups  Send quants and non‐quants to relevant conferences as attendees and eventually speakers

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 23 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Strategies for successful AMA implementations: Suggestion #3: Turn criticism into constructive feedback

 Building an AMA framework and capital quantification system from the ground up takes a great deal of time and effort –resist the temptation to argue and fight against all deficiencies or limitations noted by other constituents The AMA framework and capital models will be reviewed by regulatory agencies, internal Audit, model validators (internal and/or external) –use these opportunities for feedback to identify good ideas for strengthening risk modeling methodologies, policies, procedures, and governance

 Regulatory supervisors, internal Audit, and model validators may have more knowledge or at least different knowledge about current industry practice  Such critics/constituents can be important sources of information and potential collaborators on the project with a common goal of achieving Basel II compliance for operational risk  Generate credibility with critics/constituents by accepting feedback and asking for time to give careful thought to the issues raised before committing to a response or course of action  To resolve specific issues or observations,  Discuss feedback received with your professional network of practitioners (they may have already successfully resolved similar issues)  Ask regulatory supervisors, internal Audit, and model validators for concrete suggestions on how to resolve open issues

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 24 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. References and suggestions for further reading

 US regulatory framework and guidance  US Federal Reserve (2007). Risk‐based capital standards: advanced capital adequacy framework: Basel II; final rule. Federal Register 72(2), 69288–69445.  Federal Deposit Insurance Corporation (June 3, 2011). Advanced Measurement Approach: Supervisory Guidance. Financial Institution Letter FIL‐41‐2011.  Scenario analysis  Babbel, D. (September 24, 2010). “A Note on Scenario Analysis in the Measurement of Operational Risk Capital: A Change of Measure Approach,” Working paper, Wharton School of Business, University of Pennsylvania. Available at SSRN: http://ssrn.com/abstract=1683500.  Cope, E. (Spring 2012). “Combining scenario analysis with loss data in operational risk quantification,” The Journal of Operational Risk, 7(1), 39‐56.  Dutta, K., and Babbel, D. (July 7, 2010). “Scenario Analysis in the Measurement of Operational Risk Capital: A Change of Measure Approach,” Working paper, Wharton School of Business, University of Pennsylvania. Available at SSRN: http://ssrn.com/abstract=1565805.  Ergashev, B. (2011). “A Theoretical Framework for Incorporating Scenarios into Operational Risk Modeling,” Journal of Financial Services Research, In print, (Online version dated 02 March 2011).  Severity modeling  Cope, E. (2010). “Modeling operational loss severity distributions from consortium data,” The Journal of Operational Risk, 5(4), 35–64.  Cope, E., and Labbi, A. (2008). “Operational risk scaling by exposure indicators: evidence from the ORX database,” The Journal of Operational Risk, 3(4), 25–46.  Cope, E., Mignola, G., Antonini, G., and Ugoccioni, R. (2009). “Challenges and pitfalls in measuring operational risk from loss data,” The Journal of Operational Risk, 4(4), 3–27.  Cope, E., Piche, M., and Walter, J. (2012). “Macroenvironmental determinants of operational loss severity,” Journal of Banking and Finance, 36(5), 1362–1380.  Opdyke, J.D., and Cavallo, A. (Fall 2012), “Estimating operational risk capital: the challenges of truncation, the hazards of maximum likelihood estimation, and the promise of robust statistics,” The Journal of Operational Risk, 7(3), 3‐90.

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 25 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Questions?

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 26 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. V. About Northern Trust

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 27 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Client Centric, Highly Focused Business Model

While we do adjust our actions to align with prevailing conditions, Northern Trust has resisted the temptation to change our business or risk profile to capitalize on temporarily shifting cycles.

Businesses Northern Trust is NOT in:

. Investment Banking . Credit Cards . Sub-Prime Mortgage Underwriting . Retail Banking . Asset Backed Commercial Paper Conduits . Consumer Finance . Discount Brokerage . Venture Capital . American Depositary Receipts . Stock Transfer

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 28 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. A Recognized Market Leader

Best Private Bank in North America Serving More than 20% of Forbes 400 – Financial Times Group Most Affluent Americans (October 2011, 3rd consecutive year) – Forbes (September 2011)

Ranked among the Top 10 Wealth Managers – Barron’s (September 2011)

Best Administrator for UCITS Funds Best European ETF Administrator – HFM Week, European Hedge Fund Awards – ETF Express Global Awards (2012) (May 2011 and March 2012) European Administrator of the Year Best Custody Specialist in Asia – Funds Europe Awards (December 2011) – The Asset Magazine Awards (4th consecutive year)

Client Relationship Manager of the Year Best Outsourcing Services Company – ICFA Americas Awards (May 2010, 2011) – The Compliance Register Platinum Global Investor Services House Awards (November 2011) – Euromoney (Sept. 2011 and July 2010)

Manager of the Year – Equity Indexers (U.S.) – Institutional Investor (April 2011 assets)

13th Largest Manager of Worldwide Institutional Assets 17th Largest Asset Manager Worldwide 3rd Largest Passive International Indexed Securities Manager – Pensions & Investments (May 2011 based on December 31, 2010 assets)

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 29 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Personal Financial Services Comprehensive Approach to Serving the Affluent Market

 Cash flow analysis Financial  Debt management Planning  Tax planning PFS Assets Under Management ($ Billions)  Retirement planning CAGR +6% S&P 500 CAGR +2%  Comprehensive investment capabilities $173.7$175.9 Investment  Custom asset allocation  Broad menu of outside managers $154.4 Management $148.3 $145.2  Brokerage services $134.7 $132.4 $117.2 $110.4 $104.3 Private and  Deposit services $94.0 Business  Custom financing $87.7 Banking  Stock option lending

 Wealth transfer planning Trust & Estate  Trust and estate services Services  Philanthropic advisory services  Securities custody 2001 2003 2005 2007 2009 2011 2Q 2012

 Family education and governance Advisory  Family business Services  Non-financial asset management

Foundation and  Customized investment objectives and strategic asset allocation Institutional  Manager selection and oversight Advisors  Asset servicing and administration

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 30 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Corporate & Institutional Services Delivering a Broad Range of Solutions

 Safekeeping Asset  Settlement Processing  Derivatives and collateral processing C&IS Assets Under Custody ($ Trillions)  Income collection  Corporate actions CAGR +10%  Tax reclamation S&P 500 CAGR +2% $4.2 US$ EAFE CAGR +2%  Fund accounting $3.8 $3.7 $3.9 Asset  Transfer agency  Corporate secretarial/trustee $3.3 $3.3 Administration  Valuations  Investment operations outsourcing $2.7 $2.7 $2.3 $1.9  White label reporting  Valuation analytics $1.5 Asset $1.3  Performance analytics Reporting  Risk monitoring and reporting  Trade execution analysis

 Cross-border pooling 2001 2003 2005 2007 2009 2011 2Q  Trade execution 2012 Asset  Cash management Enhancement  Securities lending  Foreign exchange

 Active  Global index Investment  Investment outsourcing Management  Liability driven investing  Multi-manager  Transition management

The Evolution of US Basel II Operational Risk Advanced Measurement Approach 31 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved. Northern Trust Global Investments Client Focused, Diversified Investment Manager

Assets Under Management: $704 Billion

Diversified Asset Management Solutions

Across Client Segments Across Asset Classes Across Styles

Personal Short Active $176 Billion Duration Equities $328 Billion Index $215 Billion $329 Billion (46%) $321 Billion (30%) (47%) Institutional (46%) $528 Billion

Other $20 Billion Fixed Income Other (3%) Multi-Manager $140 Billion $20 Billion $35 Billion (20%) (3%) (5%)

Delivered through Various Structures

Mutual & Exchange Traded Separate Accounts Commingled Funds* Funds (ETF)

* Includes Undertakings for Collective Investments in Transferable Securities As of June 30, 2012 The Evolution of US Basel II Operational Risk Advanced Measurement Approach 32 Moody's Analytics Risk Practitioner Conference, Chicago IL, October 15-18, 2012 © 2012, Northern Trust Corporation. All Rights Reserved.