Office of the Superintendent of Financial Institutions
OSFI’s Capital Adequacy Requirements (CAR) Guideline A-1 allows
institutionsFootnote 1 to calculate capital for credit risk using an internal
ratings-based (IRB) approach. Use of the IRB approach requires
institutions to meet specific standards and to obtain the approval of
their national supervisor. Chapter 5 of CAR provides standards for the
quantification of key IRB estimates: probability of default (PD), loss
given default (LGD) and exposure at default (EAD)Footnote 2.
This document elaborates on CAR and synthesizes principles for
quantification of IRB estimates. The principles apply to all applications
of the IRB method that require PD, LGD and EAD. Adherence to these
principles will be an important consideration in OSFI’s initial approval
of institutions for IRB and ongoing use of the IRB approach.
Risk quantification is the process of assigning values to the three key
risk parameters for IRB assessments of credit risk capital in IRB
institutions: probability of default (PD), loss given default (LGD) and
exposure at default (EAD). Discipline and judgement are required for
successful application of the many methods available for risk
quantification. Institutions will plan their quantification carefully,
with attention to ratings philosophy, governance and data integrity, along
with more technical issues of statistical inference, to ensure that the
continuing commitment of resources is effective. Prompt and complete
documentation is needed to give credence to the outputs of the rating
system and to obtain regulatory approval.
Institutions may refer to CAR itself to see the specific standards
applicable to IRB. However, these standards are subject to interpretation,
and implementation by institutions is subject to OSFI approval. This
document sets out principles that OSFI expects institutions to apply to
risk quantification, with some discussion and general examples. They are
given with the understanding that the application of these principles will
be tempered with good judgment. This understanding does not negate the
principles, but may restrain their application to avoid undue costs or
perverse results. Institutions may encounter situations where the
suggested procedures have negligible impact or do not make estimates more
robust. In these cases, the institutions may consider other procedures.
Documentation is essential for process review, validation, other aspects
of good governance, and future risk quantification, but only to levels of
detail that could plausibly be useful. Lists of what "might" be done are
not exhaustive and are not meant to discourage institutions from proposing
better approaches to risk quantification.
The methods that institutions use to estimate risk parameters will depend
on their portfolio, information systems, expertise and history. However,
all institutions need to establish an effective risk quantification
framework that observes the principles outlined in this paper. OSFI will
review adherence to these principles when deciding whether or not to
approve the use of IRB methods to calculate regulatory capital.
Institutions should demonstrate that each parameter has been reasonably
estimated. To do this, they should specify and document all aspects of
risk quantification, including sample data, segmentation, estimation,
application, and the role and scope of expert judgment.
Documentation for the risk quantification process should describe how all
material and relevant aspects of risk quantification are implemented for
each parameter. As part of an institution’s risk quantification process,
institutions should consider new analytical techniques and evolving
industry practices and adopt them if they improve the accuracy of
estimates. All material changes to risk quantification should be
Institutions will use data from different sources, including sources
beyond their control. In risk quantification, institutions should
understand the data they use and adjust them for their intended use.
To estimate the IRB parameters, an institution should use data from a
population that represents the population to which the parameters will be
applied. Not only should the obligors be similar, but characteristics and
outcomes should also be defined consistently. If strict consistency is
impossible, the institution should make suitable adjustments that, as much
as possible, are based on empirical study.
Data from representative populations should be collected and adjusted for
the purpose of estimation, which is to provide inputs to the capital
formula that comply with the definitions and standards of CAR.
Institutions should review the data they use, study how they were
collected, and compare their characteristics to regulatory standards. The
institution should look to CAR and other specific guidance for many of
these standards, but a few deserve special attention here: definition of
default, economic loss, rating philosophy, and the combination of data
from different sources.
Many public studies of credit loss are based on a definition of default
that varies from the definition used in CAR. Institutions’ own data
developed for pricing and risk management may be based on a different
definition. There may be good reasons for institutions to use various
definitions in their internal systems. However, institutions are required
to compare the estimates for IRB capital to estimates used elsewhere in
the institution. Institutions are also required to use external data that
is relevant to IRB estimation and to benchmark their results to external
data. Institutions should therefore find ways to adjust estimates to a
common definition of default. In order for statistics based on the IRB
definition to be compared to other measures of default that are more or
less inclusive, institutions’ information systems should flag different
default events or horizons.
LGD is based on economic loss. Economic loss may be calculated using the
exposure at the time of default, including principal, unpaid interest, and
fees, and the present value of subsequent recoveries and related expenses
discounted at a suitable rate. The institution should model and discount
recoveries at a rate reflecting the uncertainty of recovery to arrive at
economic, rather than accounting loss. Alternatively, the market value,
net of expenses, at or near the time of default is a suitable value for
Institutions should trace or allocate recoveries and costs of recovery to
specific defaulted facilities. Then, institutions should be able to trace
or allocate recoveries to homogeneous pools with respect to LGD and to the
correct time of default. The allocation of recovery costs may require
judgment, but the process should be carefully designed to ensure that all
true recovery costs are reasonably allocated. Institutions should test the
effect of workout period assumptions on LGD parameters.
Macroeconomic factors cause credit losses to vary systemically over time.
Therefore, institutions should model credit losses so that data collected
over a term of years may be fairly compared to data from another term.
Institutions should pay attention to how exposures are classified under
rating systems. Some rating systems focus on predicting next year's
probability of default; as economic conditions change, ratings assigned to
exposures may change dynamically in response. Other rating systems are
designed to capture stress conditions and to group risks according to
characteristics that are common through economic cycles. Migrations across
ratings are infrequent and idiosyncratic; however, the default rate of
each rating group changes with the economy. Often, institutions use hybrid
rating systems. Institutions should understand the rating methodology
behind data they use for parameter estimation and decide whether an
adjustment is appropriate to improve quantification and to meet the
requirements of CAR.
Sample data for risk quantification may come from various sources. For
example, institutions often combine internal data with external data. When
developing IRB standards, institutions should follow their internal
standards for the combination of data from different sources to develop
IRB estimates. The internal standards should address:
External data will pose special challenges for the application of this
principle. However, the need to understand and make suitable adjustments
is as important for external data as it is for internal.
Institutions should document their methods used to address the sufficiency
of data in either the sample data or the existing portfolio. Here,
professional judgment may play a decisive role, but institutions should
ensure that the application of judgement does not result in parameters
that provide an optimistic view of the future.
As much as possible, estimates should be based on relevant data,
especially data from an institution’s own experience. However, for some
portfolios there may be inadequate data. For these portfolios, estimates
may be based on careful judgement; however, such judgment should not be
biased toward low estimates of risk and reducing required capital.
Instead, conservatism should be used to address the uncertainty. The
institution should document the reasoning and any empirical support for
the estimate, as well as the mechanics of the estimation.
Although this principle allows institutions to use the IRB method when
institutions cannot provide at robust estimates from internal or external
data, approval to use the IRB method will depend on an institution’s
continued efforts to obtain accurate and relevant data.Footnote 3
Institutions should identify risk drivers to help classify exposures into
homogenous groups. Institutions should justify their segmentation schemes,
evaluating the advantages and disadvantages of using fewer or more risk
Institutions should identify risk driversFootnote 4 for each risk parameter. In
selecting which risk drivers to use, an institution should consider its
own practices in the origination, acquisition and management of exposure,
the practices of peer institutions (where available), and studies from
industry associations and academics.
Institutions should use the most discriminating risk drivers to segmentFootnote 5
portfolios into homogenous groupsFootnote 6, i.e., groups that are similar with
respect to PD, LGD or factors used to arrive at EADFootnote 7. An
institution should use a risk driver to segment risks if this improves
estimates. Granular segments provide more valid estimates as the
composition of a loan portfolio changes. However, finer segmentation also
results in small groups of obligors. The observed default rates and loss
severity for the small groups will be more volatile, adding uncertainty to
risk estimates and validation. In designing their segmentation of risk,
institutions should justify their choice of risk drivers and the structure
of risk grades to which estimates of PD, LGD or EAD are assigned.
Institutions should develop their estimates of PD, LGD and EAD from data
collected over a sufficient term to meet the standards of CAR.
Institutions should study their own experience over time with special
attention to the response of their ratings assignment and risk estimates
to macroeconomic conditions and changes in risk management.
Institutions should develop IRB parameters using long-term data and should
model the behaviour of IRB parameters that result from their methodology
through time. CAR specifies that institutions should have at least five to
seven years of data to use the IRB method, but an average of five to seven
years of data may not meet the requirements for a long-term average, and
may not meet the requirements to include stress years. For EAD and LGD,
institutions should not only incorporate data from stress years, but
should also consider the correlation of LGD and EAD to default rates.
(Refer to paragraphs 468 and 475 of CAR Guideline A-1.)
Parameter estimates are intended to be predictive of future outcomes.
Institutions should identify sources of uncertainty in risk quantification
and document how they have addressed the uncertainty and the rationale for
Institutions should estimate values of PD, LGD, and EAD as precisely and
accurately as possible. However, such estimates are subject to uncertainty
and, therefore, potential errors. In order to avoid over-optimism, an
institution may need to adjust its estimates by adding a margin of
conservatism. The extent of such adjustments should be related to factors
such as the relevance and the quality of the sample data, the precision of
the statistical estimates, and the amount and nature of judgment used
throughout the process. For example, institutions could produce loss
distribution curves and confidence intervals of estimates with different
Institutions should develop policy for the application of conservatism.
For each estimate, they should also identify the sources of uncertainty,
the range of uncertainty from each source, and the level of conservatism
used. This tracking is necessary to assess the overall level of
conservatism used, to verify that the level is adequate, and to modify
conservatism suitably as new data becomes available.
To build a rational approach to conservatism, institutions should classify
sources of error. Many classifications are possible, but there should be a
sound connection between the classification and how the institution
handles potential for error. Some types of uncertainty may be better
handled at different levels of risk quantification than others. The
application of conservatism at every step to cover a large portion of
outcomes could lead to excessive conservatism overall. Therefore, the institution should focus on adequate margins for capital,
rather than for each estimate.
In its classification of sources of error, an institution might address:
For each source of error, the institution should consider whether the
overall degree of conservatism used by the institution is appropriate.
Risk quantification should be a dynamic process that responds to internal
and external events.
Institutions should have a consistent process to ensure that new data are
incorporated into the PD, LGD and EAD estimates as they become available.
The need to use fresh internal data is obvious as new business replaces
old and long-term customers change. However, institutions should also set
up processes to identify and incorporate relevant external data. They
should consider changes in the competitive environment that might affect
the risk characteristics of their own customers. Changes in the external
environment, the institutions’ own practices and its mix of customers will
affect the usefulness of some factors in predicting risk. Reviews of the
external and internal environment should be regular and comprehensive.
Estimates should be reviewed and updated when required and at least once a
year. However, the institution should respond more rapidly to special
With respect to each homogeneous pool/grade of risks for IRB estimation,
institutions should maintain logs of significant changes to institution
practice and the external environment (as applicable) that could be
expected to affect the behaviour of the pool or grade.
Most of the principles for IRB risk quantification elaborated here imply
the good practices that institutions should apply in their capital
management and projections of loss. Some, such as the attention to
macroeconomic factors and the incorporation of conservatism, are
requirements of CAR that may not be in place for other purposes. All
principles should be followed carefully to develop the risk parameters
that drive capital under the IRB approach. In particular, institutions
should recognize the uncertainties of their data and assumptions; any bias
in their calculations should result in higher regulatory capital.
Banks and bank holding companies to which the Bank Act applies
and federally regulated trust or loan companies to which the Trust and
Loan Companies Act applies are collectively referred to as
Return to footnote 1 referrer
Institutions using the Foundation IRB approach use Supervisory Estimates
of LGD and EAD.
Return to footnote 2 referrer
For further discussion, refer to OSFI’s Implementation Note, Data
Maintenance at IRB Institutions.
Return to footnote 3 referrer
Here, risk driver denotes a factor that helps classify risk. For
example, loan to value would generally be considered a risk driver for PDs
in the retail mortgage business because high loan to value is generally
associated with high default rates.
Return to footnote 4 referrer
Since these risk quantification principles are designed to be applicable
to both retail and non-retail portfolios, segmentation could mean retail
pools, wholesale rating grades or risk buckets.
Return to footnote 5 referrer
Often called “pools” in retail banking and “grades” or “buckets” in
Return to footnote 6 referrer
Institutions may use a regression or other model of risk as a function
of risk drivers to develop the IRB components, PD, EAD or LGD. Modeling an
IRB component as a continuous function of a risk driver may be equivalent
to segmentation. Either way, risk drivers explain performance, and changes
in the prevalence of risk drivers will suitably change estimates of
Return to footnote 7 referrer