PRISM at the CBI... A Guide - Part 1 of 3

I worked for a while with the Central Bank of Ireland's Risk Division and one of the things I get asked a lot about a lot is something called "PRISM"... this is the Central Bank of Ireland's risk-based supervision framework - PRISM stands for Probability Risk and Impact SysteM. The framework established a new approach for supervisory engagement with Irish regulated firms. Nice and simple?

Well, the thing that has suprised me is how some of the simplest concepts of PRISM have not been fully understood by the people in the regulated firms... what follows is just an explanation of Impact and Probability Risk - if you understand these, then you have a good grounding in how PRISM works. I will do a follow-up on Engagement and Risk Mitigation Programmes...

Note: When I joined the Central Bank, I signed a confidentiality agreement... they very kindly gave me a copy of this when I left... and a gentle reminder of the consequences of breaking it. Everything below can be found in the Central Bank's excellent PRISM Explained document. To prove this I have included quotes from the document where needed...all quotes are in italics and can be found in PRISM Explained...

What is PRISM?
Now, to get you started, here is an interview I did with William Mason, my old boss and the Head of the Central Bank's Risk Division at the recent GRC Summit in Farmleigh House. He talks about PRISM from about 01:35 in the below:

However the whole piece is important... the comments on business models and "getting behind the numbers" at the start will be important to your understanding of PRISM. To quote PRISM Explained, PRISM makes it "easier for our supervisors to challenge the financial firms they regulate, judge the risks therein and take action to mitigate those risks".

The important work here is "judge" - quantitative or "black box systems were understood by few (and bitter experience indicates that even those few had limited understanding) and thus were not subject to adequate challenge". We'll come back to that when we are looking at Probability Risk... first we need to understand the difference between Impact and Probability Risk. Have a look at the below:

Impact
Note that from left to right we have increasing Impact - from Low through to High. Impact for a firm is calculated using information received by the Central Bank in items such as regulatory returns. These are "combined to calculate an impact score for each firm so that, for each sector, we have a list of all the firms in that sector ordered by impact. These lists were used to divide all regulated firms into four categories: high impact, medium-high impact, medium-low impact and low impact."

Impact metrics are found in appendix C of PRISM Explained, but let's keep this simple. Let's say you take a simple model that balance sheet size drives the impact of firms in a sector... then the bigger your balance sheet, the higher your impact and thus the further to the right on the diagram your firm will fall.
Now this is important... as this is driven by regulatory returns, then the only convenient way to change the impact category of a firm is to do something like reducing your balance sheet size. What you can influence is your probability Risk... By the way the Central Bank did do a consultation on this impact approach - see CP49... if you didn't comment then, then it may be too late...

Probability Risk
So what happens next? Well, the supervisor in the Central Bank now has to make a judgement on the risk of a firm. "Supervisors will form judgments on the risk probability posed by the firm in relation to each category. PRISM is a judgement- based system in that supervisors of higher impact firms will be required to make a conscious choice as to the riskiness of a firm at each level in each category."

Note two things fro the above - they are going to do this per a set of risk categories and this depends on the impact category of the firm... what I am going to explain below will be for firms in higher impact categories. As for "our low impact firms, we aim to regulate to avoid sector-wide issues - such as widespread misselling by intermediaries - but there are circa ten thousand low impact firms and we will not seek to prevent individual failure. Rather, we will supervise these firms reactively - ensuring that an administrator or liquidator is appointed when they fail and that there is an orderly revocation of authorisation and winding-up in accordance with insolvency legislation"

On the question of categories - have a look at this:

Start from the top... the "Overall Risk Rating" is the overall Probability Risk for a firm. This is driven by the categories below - so the supervisor will review the firm for Credit Risk, Market Risk etc. And for each category there are sub categories, so for Credit Risk, the supervisor will record their judgement on items such as the "Concentration of Credit Risk" for a firm. They can be guided by Key Risk Indicators or KRIs - so the supervisor might look at the data for how concentrated a firm is in it's lending to a certain set of customers or customer segment.

This drives the overall Credit Risk which may ultimately drive the overall risk rating for a firm... but note, this is the judgement of the supervisor... even if the KRIs for a firm are looking acceptable, they will be expected to record their opinion of the firm and not just signing off a set of numbers... it's not just looking at the output of a "black box" and ticking a box... they need to understand why a firm is in the business it is in and if it can sustain that business. Thus supervisors are asking a lot more questions of regulated firms...

It's interesting to note that the above can be taken to be a simple taxonomy of risks... more on this and ontologies in a future entry...

Conclusion
So let's put it all together:

• Impact measures the cost or damage the failure of a firm would have to the economy. It is calculated from regulatory returns. 
• In the above firm A's failure would have more of an impact on the economy than firm B. In a simple model based on just balance sheet size, we would expect Firm A to have a larger balance sheet in Euro than firm B.
• The only way to move a firm between impact categories is to reduce the impact score. For Firm X to move to the same impact category as firm Y, it would have to do something like reduce it's balance sheet size.

• Probability Risk is based on the judgement of the supervisor as to the probability that a firm will fail.
• In the above firm C has been judged to have a higher probability risk than firm B. This is based on the judgement of the supervisor and not just data such as KRIs.
• A firm can move between probability risk ratings by mitigating their risks and showing the supervisor the results of this... they will then change their judgement of the probability risk of the firm and it will move to a lower overall probability risk rating.
• Thus firm X could move to a overall risk rating of firm Y by showing risk mitigation.

More to follow on Risk Mitigation and Engagement tasks with the Central Bank in a future entry.