Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice
Print- Introduction
- Foundational Risk Management
- Internal Controls
Internal Controls
As with other aspects of key risk-management and finance area functions, a BHC should have a strong internal control framework that helps govern its internal capital planning processes. These controls should include (1) regular and comprehensive review by internal audit; (2) robust and independent model review and validation practices; (3) comprehensive documentation, including policies and procedures; and (4) change controls.
Scope of Internal Controls
A BHC's internal control framework should address its entire capital planning process, including the risk measurement and management systems used to produce input data, the models and other techniques used to generate loss and revenue estimates; the aggregation and reporting framework used to produce reports to management and boards; and the process for making capital adequacy decisions. While some BHCs may naturally develop components of their internal capital planning along separate business lines, the control framework should ensure that BHC management reconciles the separate components in a coherent manner. The control framework also should help assure that all aspects of the capital planning process are functioning as intended in support of robust assessments of capital needs.
BHCs with stronger control coverage reviewed the controls around capital planning on an integrated basis and applied them consistently. Management responded quickly and effectively to issues identified by control areas and devoted appropriate resources to continually ensure that controls were functioning effectively.
Internal Audit
Internal audit should play a key role in evaluating internal capital planning and its various components. Audit should perform a review of the full process, not just of the individual components, periodically to ensure that the entire end-to-end process is functioning in accordance with supervisory expectations and with a BHC's board of directors' expectations as detailed in approved policies and procedures. Internal audit should review the manner in which deficiencies are identified, tracked, and remediated. Audit staff should have the appropriate competence and influence to identify and escalate key issues, and the internal audit function should report regularly on the status of all aspects of the capital planning process--including any identified deficiencies related to the BHC's capital plan--to senior management and the board of directors.
BHCs with stronger audit practices provided a comprehensive, robust review of all components of the capital planning process, including all of the control elements noted earlier.10 BHCs with leading internal audit practices around internal capital planning had strong issue identification and remediation tracking as well. They also ensured that audit staff had strong technical expertise, elevated stature in the organization, and proper independence from management.11
Independent Model Review and Validation
BHCs should conduct independent review and validation of all models used in internal capital planning, consistent with existing supervisory guidance on model risk management (SR Letter 11-7).12 Validation staff should have the necessary technical competencies, sufficient stature within the organization, and appropriate independence from model developers and business areas, so that they can provide a critical and unbiased evaluation of the models they review.
The model review and validation process should include
- an evaluation of conceptual soundness;
- ongoing monitoring that includes verification of processes and benchmarking; and
- an "outcomes analysis."
BHCs should maintain an inventory of all models used in the capital planning process, including all input or "feeder" models that produce projections or estimates used by the models that generate the final loss, revenue or expense projections. Consideration should be given to the validity of the use of a model under stressed conditions as models designed for ongoing business activities may be inappropriate for estimating net income and capital under stress conditions. BHCs should also maintain a process to incorporate well-supported adjustments to model estimates when model weaknesses and uncertainties are identified.
BHCs continue to face challenges in conducting outcomes analysis of their stress testing models, given limited realized outcomes against which to assess loss, revenue, or expense projections under stressful scenarios. BHCs should attempt to compensate for the challenges inherent in back-testing stress models by conducting sensitivity analysis or by using benchmark or "challenger" models. BHCs should ensure that validation covers all models and assumptions used for capital planning purposes, including any adjustments management has made to the model estimates (management overlay).
Supervisory reviews have found that, in general, BHCs should give more attention to model risk management, including strengthening practices around model review and validation. Nonetheless, some BHCs exhibited stronger practices in their capital planning, including
- maintaining an updated inventory of all models used in the process;
- ensuring that models had been validated for their intended use; and
- being transparent about the validation status of all models used for capital planning and appropriately addressing any models that had not been validated (or those that had identified weaknesses) by restricting their use, or using benchmark or challenger models to help assess the reasonableness of the primary model output.
BHCs with lagging practices were not able to identify all models used in the capital planning process. They also did not formally review all of the models or assumptions used for capital planning purposes (including some high-impact stress testing models). In addition, they did not have validation staff that were independent and that could critically evaluate the models.
Policies and Procedures
BHCs should ensure they have policies and procedures covering the entire capital planning process.13 Policies and procedures should ensure a consistent and repeatable process for all components of the capital planning process and provide transparency to third parties regarding this process. Policies should be reviewed and updated at least annually and more frequently when warranted. There should also be evidence that management and staff are adhering to policies and procedures in practice, and there should be a formal process for any policy exceptions. Such exceptions should be rare and approved by the appropriate level of management.
Ensuring Integrity of Results
BHCs should have internal controls that ensure the integrity of reported results and the documentation, review, and approval of all material changes to the capital planning process and its components. A BHC should ensure that such controls exist at all levels of the capital planning process. Specific controls should be in place to
- ensure that MIS are sufficiently robust to support capital analysis and decisionmaking, with sufficient flexibility to run ad hoc analysis as needed;
- provide for reconciliation and data integrity processes for all key reports;
- address the presentation of aggregate, enterprise-wide capital planning results, which should describe any manual adjustments made in the aggregation process and how those adjustments compensate for identified weaknesses; and
- ensure that reports provided to senior management and the board contain the appropriate level of detail and are accurate and timely. The party responsible for this reporting should assess and report whether the BHC is in compliance with its internal capital goals and targets, and ensure the rationale for any deviations from stated capital objectives is clearly documented and obtain any necessary approvals.14
BHCs with stronger practices in this area ensured that good information flows existed to support decisions, with significant investment in controls for data and information. For example, some BHCs had an internal audit group review the data for accuracy and ensured that any data reported to the board and senior management were given extra scrutiny and cross-checking. In addition, BHCs with stronger practices had strong MIS in place that enabled them to collect, synthesize, analyze, and deliver information quickly and efficiently. These systems also had the ability to run ad hoc analysis to support capital planning as needed without employing substantial resources. Other BHCs, however, continue to face challenges with MIS. Many BHCs have systems that are antiquated and/or siloed and not fully compatible, requiring substantial human intervention to reconcile across systems.
Documentation
BHCs should have clear and comprehensive documentation for all aspects of their capital planning processes, including their risk-measurement and risk-management infrastructure, loss- and resource-estimation methodologies, the process for making capital decisions, and efficacy of control and governance functions.15 Documentation should contain sufficient detail, accurately describe BHCs' practices, allow for review and challenge, and provide relevant information to decisionmakers.16
References
10. See 12 CFR 225.8(d)(1)(iii). Return to text
11. See SR Letter 13-1, "Supplemental Policy Statement on the Internal Audit Function and Its Outsourcing," (January 23, 2013) www.federalreserve.gov/bankinforeg/srletters/sr1301.htm, for detailed guidance on expectations for the governance and operational effectiveness of an institution's internal audit function. Return to text
12. See SR Letter 11-7, "Supervisory Guidance on Model Risk Management," (April 4, 2011), www.federalreserve.gov/bankinforeg/srletters/sr1107.htm. Return to text
13. See FR Y-14A reporting form: Summary Schedule Instructions, pp. 5-7. Return to text
14. See id. Return to text
15. See id. Return to text
16. See id. Return to text
