Financial risk management and modelling consulting

Powered by machine learning and AI and built on ever-increasing computational capabilities, complex mathematical models are rapidly becoming one of the linchpins of risk management and, by extension, directly impacting banking operations.

Techniques from mathematical statistics, big data analytics, and artificial intelligence are employed to predict likely future outcomes based on historical datasets. Nowadays, a wide range of mathematical models is used, from more traditional methods such as linear or logistic regression, principal component analysis and hierarchical clustering to more advanced machine learning techniques, including random forests, gradient boosting, neural networks and Bayesian updating.

As such, credit risk models play a crucial role in various aspects of risk management, accompanying a client’s lifecycle from loan origination via both credit scoring as well as risk- based pricing, to ongoing monitoring of clients’ risk profile. These models are essential for estimating both expected credit losses (for Loan Loss Provisioning) and unexpected credit losses (for Capital Management under the IRB approach). 

Key focus areas

1. Credit scoring models

2. Risk-based pricing

3. Loan loss provisioning

4. Internal ratings-based approach (IRB)

5. Model risk management

ESG (Environmental, Social and Governance) risks have fallen under increased regulatory scrutiny, placing pressure on banks' modelling teams to incorporate these new risks into their credit risk models – both transactional and portfolio. Current requirements are limited to managing these risks through: (i) the loan origination process, (ii) special-purpose stress-testing tools, and (iii) specialised disclosures. However, in the future, these risks will have to be  integrated into Basel and IFRS frameworks. Furthermore, banks that fail to prepare for these tasks in advance could be subject to increased capital requirements under Pillar 2 within Basel III and, more formally, within Basel IV.

Notwithstanding regulatory pressures, ESG modelling also represents a significant business opportunity (both green and brown), provided that the framework is well adapted to the bank's business model.

Challenges in ESG modelling

▪ Many ESG-related risks have yet to materialise, making traditional model calibration difficult ▪ Physical and transitional risks behave differently and have different transmission channels

▪ Dynamic balance-sheet assumptions require more sophisticated calculation methods to avoid excessive calculation times

 ▪ Limited data availability and inadequate infrastructure for data collection pose significant challenges 

At PwC, we offer a comprehensive approach to tackling these challenges, helping banks to accurately assess ESG-related risks and effectively demonstrate their ability to do so to all stakeholders.

Risk Appetite Framework

The Risk Appetite Framework (RAF) is essential for financial institutions, aligning risk management with business strategies to support sustainable growth. Governed by Article 74 of Directive 2013/36/EU, the RAF establishes a clear organisational structure with well-defined responsibilities. The framework outlines processes for identifying, managing, monitoring and reporting risks, including reputational risk. It aligns business strategy with risk appetite, defines risk capacity and assigns risk ownership. The RAF supports a sound risk culture and integrates ICAAP and ILAAP processes. By aligning with remuneration and risk management policies to maintain a balance between risk and reward, it supports regulatory compliance and organisational goals.

ICAAP

The Internal Capital Adequacy Assessment Process (ICAAP) plays a crucial role in risk management for financial institutions, aligning with their risk appetite and organisational structure. This comprehensive framework facilitates the identification and assessment of risks at the transaction, product and process levels. The ICAAP framework sets internal capital adequacy limits to ensure sufficient resources are available to cover risks. Capital planning within ICAAP is forward-looking, encompassing strategies for managing and planning capital allocation. It includes robust risk quantification methodologies, validated to ensure accuracy and stability. Internal capital should align with the institution’s economic capital adequacy concept. ICAAP also mandates institution-wide stress testing to identify vulnerabilities under adverse conditions, thereby informing a tailored stress-testing programme. Institutions are required to maintain comprehensive internal and regulatory reporting on ICAAP, ensuring clarity and accountability in the reporting process. The ICAAP framework supports financial institutions in managing both current and potential risks efficiently.

Liquidity Risk Management Framework (ILAAP)

The Liquidity Risk Management Framework, guided by the BCBS Principles for Sound Liquidity Risk Management and Supervision (2008), is essential for  ensuring the sustainability and resilience of financial institutions. It involves setting up an organisational structure based on the 3 Lines of Defence concept, establishing clear roles and responsibilities within risk management processes. The framework emphasises severe yet plausible stress testing, including both sensitivity and scenario-based tests, and focuses on intraday liquidity management. It also requires the development of effective contingency liquidity plans, tailored to the institution's scale and complexity. Aligning liquidity risk appetite with the business plan is essential. This framework aids senior management in achieving business objectives within the defined risk appetite, optimising liquidity management costs and selecting favourable funding options. It provides comfort during stress periods by addressing aspects such as non-maturing deposits, loan prepayments, and early withdrawals of term deposits, ensuring comprehensive liquidity risk management.

The Capital Requirements Regulation (CRR), together with the Capital Requirements Directive (CRD), forms a fundamental part of the European Union's banking framework, ensuring financial institutions' stability and resilience by setting prudential capital requirements. These requirements aim to enhance banks' ability to absorb losses, particularly during economic downturns. The evolving regulatory landscape has led to the proposal of CRR III, set to take effect from January 2025, introducing significant changes for banks. Under CRR III, banks using the standardised approach will face new risk-weight assignment rules, while those using the internal ratings-based approach must incorporate the standardised approach as a baseline for calculating risk-weighted assets. The revised methodology will increase risk sensitivity, requiring more comprehensive data collection. Additionally, new reporting requirements, including ESG disclosures, will be introduced. Non-EU banks will experience similar changes, with some deviations due to differences in transitional periods and risk-weight assignments compared to Basel IV.

How should banks prepare for CRR III?

In order to effectively prepare for the new CRR III regulation, banks must adopt a proactive approach. The first step is in preparing for CRR III is to conduct a thorough impact assessment to determine the specific impact of the new regulation on the bank’s portfolios. Once the impact has been evaluated and quantified, the bank must develop an implementation plan. Establishing an adequate implementation strategy is crucial, as the end-to-end implementation can be a rather complex process.

Starting the implementation process well in advance is equally important, as it allows for sufficient time for testing the implemented rules, training staff and addressing any challenges that may arise during the process. After the bank finalises the CRR III implementation, it is advisable to have an independent reviewer assess its overall quality and effectiveness.

This external evaluation can help identify potential areas for further improvement, ultimately leading to better capital optimisation.

1. Impact assessment
2. Evaluation of the current RWA calculation process 
3. Identification of key impacted areas 
4. Determination of potential additional data requirements 
5. Assessment of future capitalisation strategies 
6. Preparation of required next key steps
7. Implementation process

Gap analysis: 

–  Methodological 

–  Technological 

–  Data availability 

Alignment of internal policies and methodologies 

Execution of a parallel run to systems and processes 

Integration of new risk-weighting calculations into internal and external risk reports

Review of the implementation

Verification of correct exposure classification

Verification of accurate risk weight assignment 

Re-performance of the SA-CR model 

Strategic assessment of IRB models at the portfolio level

The CRR III introduces multiple changes to the IRB credit risk framework, significantly impacting banks and overall capital requirements. These changes should be carefully considered during the implementation of CRR III requirements.

Scope

• Removal of the IRB approach for equity exposures 
• Removal of the Advanced IRB approach (A-IRB) for banks, other financial sector entities and large corporates 
• Introduction of a new exposure class for regional governments, local authorities and public sector entities 
• Elimination of the 1.06% scaling factor
• IRB roll-out and permanent partial use
• The adoption of IRB approaches for a single exposure class by banks is no longer contingent on applying the IRB approach to all exposure classes 
• Banks are allowed to revert from the IRB to the SA-CR approach for any exposure class until 31 December 2027
• Estimation of parameters
• Revised calculation methods for own estimates of CCF 
• Revised scope of products for which CCF can be modelled
• Introduction of new minimum floors for risk parameters under A-IRB
• For corporates and retail: New PD input floor set at 0.05%, LGD input floors are based on the foundation IRB approach (F-IRB) 
• Specialised lending: Transitional factor applied to the LGD floor 
• Sovereign exposures: PD, LGD and CCF input floors do not apply
• New risk parameters for F-IRB
• Introduction of a PD floor 
• Reduced minimum secured LGD 
• Prescribed unsecured LGD for corporates and institutions 
• Increased LGD haircuts
• Credit risk mitigation techniques
• Revised haircuts applicable to financial collateral under the financial collateral comprehensive method and values of secured LGDs and collateral haircuts applicable under F-IRB 
• Reversion to less sophisticated approaches for exposures guaranteed by SA or F-IRB guarantors 
• Clarification of eligibility criteria for guarantees 
• Removal of the double default treatment
• Output floor (OF)
• Limits on the RWA reduction that can be achieved using the IRB models compared to the standardised approach
• Introduction of transitional rules for preferential RW assignment for unrated corporates and exposures secured by mortgages on residential property 
• Phased implementation of the OF over five years, reaching 72.5% in 2030

“Risk culture … the institution’s norms, attitudes and behaviours related to risk awareness, risk taking and risk management.

(FSB Guidance on Supervisory Interaction with Financial Institutions on Risk Culture, 2014)”

Risk culture varies across financial institutions. However, certain common fundamental elements determine a sound Risk Culture within an institution, such as:

• Effective risk governance 
• Effective risk appetite framework 
• Compensation practices that promote appropriate risk-taking behaviour 

PwC's globally recognised Risk Culture Assessment Methodology recognises six focus areas: Leadership, Governance and Organisation, Communication, People Management, Incentivisation and Accountability.

This initiative assesses risk culture attributes across these focus areas using specialised tools, ensuring consistent deployment of the methodology. There are four key techniques for assessing the attributes: a Risk Culture Survey for all employees, desktop research aimed at reviewing policies and procedures, interviews with the key stakeholders and focus groups discussing specific risks.

The assessment includes both qualitative and quantitative elements. While a universally accepted terminology for evaluating risk culture maturity does not exist, there is a broad consensus on a five-level maturity model. PwC’s methodology defines maturity levels as Basic, Developing, Defined, Managed, Optimised.

For attributes assessed as “Defined” or below, qualitative analysis is used to identify improvement opportunities and formulate actionable recommendations.

Sound Risk Culture

A sound risk culture consistently supports appropriate risk awareness, behaviours, and judgments relating to risk-taking within a robust risk governance framework. 

It bolsters effective risk management, promotes prudent risk-taking and ensures that emerging risks or risk-taking activities beyond the institution’s risk appetite are promptly identified, assessed, escalated, and addressed.

There are six key focus areas when creating and sustaining an effective risk management culture:

• Leadership & Strategy
• Accountability
• Incentivisation
• People and Talent Management
• Governance & Organisation
• Communication

Regulatory Stress Testing

One of the key responsibilities of the national supervisory authority is to ensure the orderly functioning and integrity of financial markets and to uphold the stability of the financial system. A stress test exercise is the primary supervisory tool used for this analysis, designed to assess the resilience of financial institutions to adverse market developments and contribute to the overall assessment of systemic risk within the financial system.

The stress test is based on both baseline and severe scenarios, which are mandatory for all banking institutions.

Individual banks develop transitional mechanisms based on the complexity of their products and portfolio structures.

Stress test deliverables

Stress tests provide qualitative insights into transmission mechanisms and potential deviations, complemented by quantitative data such as stressed Income Statements and Balance Sheets over a three-year horizon. They assess the impact on credit, market, and operational risks, with a particular focus on capital adequacy. Since 2021, ESG factors have been integrated into traditional risks.

Internal Stress Testing

In addition to regulatory stress-testing exercises, financial institutions are required to conduct internal stress tests at least annually under Pillar 2, covering credit, market, operational, and liquidity risks. Unlike regulatory stress tests which follow a "one-size-fits-all" approach, internal stress tests can be tailored to the institution's specific risk profile and are not constrained by unnecessary regulatory conservatism. This makes them a more valuable tool for top management.

The standard market practice relies on three distinct approaches, each serving as a powerful tool with  unique characteristics. These approaches primarily differ in how  scenarios are generated:

• Sensitivity analysis evaluates specific risks and potential impacts using simple key risk indicators, without assigning probabilities.
• Stress-testing uses narrative-rich scenarios across portfolios, incorporating assigned probabilities.
• Integrated stress-testing involves comprehensive scenarios encompassing all risk types, requiring complex modeling, often sourced externally or using internal economic models.

Climate Stress Testing

Climate change is expected to expose systemic risks in the financial sector, both through its physical impact on the economy (physical risk) and the gradual transition towards a low carbon-economy (transitional risk). Climate stress testing aims to detect these risks and gauge financial institutions’ exposure. Unlike regular stress-testing exercises, climate risk stress tests do not provide any information on capital depletion. Instead, they include multiple components aimed at exploring institutions’ preparedness for tackling and managing climate-related risks. This approach considers different angles, taking into account both qualitative and quantitative elements.