Operational risk at Zions Bancorporation

RMA Journal, The, Nov, 2002 by David Stone

Last summer, Zions Bancorporation began deploying its new risk assessment system. This standardized, Web-based approach is an effort to create a more robust risk management culture--one where business and support groups work proactively to identify, assess, and manage risk in order to ensure service excellence to customers and consistent returns to shareholders.

Enterprise risk management was conceived with twin goals in mind:

* Roll up different types of risk (such as operations, compliance, credit, market, strategic, reputation) into an organizational risk profile.

* Create a more risk-focused culture, where business groups have greater ownership of risk and more effectively manage its identification, measurement, monitoring, and control.

The ongoing challenge for enterprise risk assessment has been to continuously align risk assessments with business objectives and to ensure that business lines use those assessments to strengthen risk management practices in day-to-day operations.

While improved systems have helped firms deploy risk assessment, a number of important challenges remain. Those challenges, detailed below, include software design issues, deployment depth, sustainability, data integrity, and validation:

* There is a scarcity of risk assessment systems that support Basel Accord guidelines on operational risk and that integrate various risk tools, such as risk assessment, key risk indicators, and loss history.

* Reporting capabilities can be limited, making it difficult for executive management, business lines, or assurance groups to use risk data in day-to-day operations.

* Screen designs can be cumbersome and can require significant training.

* Systems lack robust project management/work-flow capabilities, making it difficult to know the status of risks; without these capabilities, risk assessment is more difficult to deploy, update, and sustain.

* Audit interfaces can be limited, making risk validation more complex.

These challenges have caused many banks to defer conducting risk assessments in their business lines. Instead of deploying business risk assessment, several banks have pursued an almost exclusively quantitative approach to identifying and managing operational risk.

Unfortunately, the reliance on quantitative data alone has not fully advanced the risk management cause. In many cases, data quality and availability are inadequate, making it difficult to create a reliable risk profile. Consequently, results have provided more of a back-test of exposure than a future projection of risk.

Regulatory Interest and Payback

Interest in risk assessment has increased in recent months as the Basel Committee on Banking Supervision issued statements providing criteria on effective operational risk management. In summary, Basel's December 2001 paper asks banks to:

1. Implement an ongoing system to identify, measure, monitor, and control risk across all key business lines, processes, and products.

2. Provide risk reporting at all levels, from the board to senior and line management.

3. Ensure Internal Audit's independence to validate risk management processes and levels.

4. Publicly disclose operational risk management practices and results.

Basel II proposes that fixed regulatory capital guidelines will be replaced with economic capital calculations based on a bank's assessment of its risks. U.S. regulators indicate they will insist that large, internationally active banks comply with Basel's AMA guidelines, but that they will leave the option for other banks to decide for themselves.

Zions Bancorporation, based in Salt Lake City, does little business outside the U.S. However, Zions has a strong focus on improving risk management to better serve its customers and shareholders and intends to adopt Basel II AMA guidelines.

By implementing these guidelines, Zions expects to position itself to reduce its operational risk capital requirements by 25% or more. Assuming no other binding capital constraints, Zions could return that capital to shareholders in the form of increased dividends or stock buybacks. Alternatively, Zions could reinvest those funds in its businesses. Based on current projections, and assuming an after-tax return on capital of 12%, Zions could earn several million dollars on those funds.

Sarbanes-Oxley. Efforts to meet Basel's AMA guidelines are consistent with Zions' internal objectives on operational risk. These same efforts can be used to support recent Sarbanes-Oxley legislation that calls on U.S. companies to:

1. Establish, assess, and certify internal controls.

2. Alert management and Audit of all significant deficiencies or changes in controls.

3. Notify management and Audit on the status of corrective actions.

Zions' Ops Risk Approach: Defining Goals, Tools, and Methodology

Zions' goals. Zions wanted to create an enterprise-wide risk assessment system that would reinforce and strengthen operational and other risk management practices across its subsidiaries. The goal is to encourage business and support groups to think more proactively about risk. Zions wanted to enhance its risk culture by helping teams better identify, measure, and manage risk to enable them to more effectively serve their customers and compete in the market. To accomplish this, Zions needed a risk management system that could be easily deployed to act as a management tool for analysis and decision making, rather than an annual survey that would have only a marginal impact on business behavior.