1. Strategy, Risk and Capital Management - An ICAAP Framework August 2009 Hasan Kazmi Director – Enterprise Risk European Capital Markets Royal Bank of Canada

2. Objectives Following are some of the issues I look to address in this presentation: Relationship between risk & capital; Process for determining capital requirements in the context of risk; Identify factors impacting level of capitalisation; Relationship between risk, treasury and business management functions; ICAAP requirements; Lessons learnt and pitfalls to avoid; Please note that this presentation is based on my personal experience and opinions and does not necessarily reflect on the management views or process of my employer.

3. What an ICAAP should not be!

4. Executive Management Health Check QuestionsYesNo Is your corporate strategy sufficiently articulate with respect to the type, size and quality of risk your organisation is taking? Do you have a clear understanding of how your strategy impacts your financial performance with respect to volatility of earnings, balance sheet size and leverage? Do you have an appreciation of the primary drivers (internal and external to the organisation) which impact your risk profile? Do you appreciate the volatility of your risk profile under normal and extreme but plausible operating environments? Does the executive function actively identify the risk return trade-off and optimise business decisions in the interest of the shareholders? 5/5 = Exceptional executive engagement 4/5 = Executive function is diligent in value creation 3/5 = Fair engagement but some concerns 2/5 = Executive function leaving a lot to chance 1/5 = Executive function is ineffective 0/5 = Time to move to a safer bank! Put yourself in the CEO’s position and ask yourself the following questions:

5. Relationship Between Risk & Capital and Capital Adequacy Framework

6. Financial Institutions are vital economic agents as they perform the following vital functions: Price risk Warehouse risk, Transform and transfer risks. But there is a paradox; financial institutions have traditionally lagged behind other sectors in assessing and communicating the nature of the risks they are assuming. Investors Discount Bank Stocks: Complexity and Lack of Transparency Source: Stradea Consulting Primary sources of competitive advantage Risk & Financial Services Sector

7. What do we mean by risk? Risk is defined as any unexpected event or development, either internal or external to the organisation, which may have a disproportionate impact (positive or negative) on the performance of the organisation. Risk is quantified in terms of both the likelihood (probability) and impact of a risk event. The relationship between probability and size of impact is represented by a risk distribution curve. Loss Distribution 0.0% 0.5% 1.0% 1.5% 2.0% 2.5% 3.0% 160140120100806040200 Potential Loss ($mm) Probability of Loss Expected Loss 99.96% Confidence level Unexpected Loss σ Note - 99.96% CI equates to a 1 in 2500 event.

8. Capital & Risk Three Potential Uses of Capital: Fund business operations Act as buffer against risk (unexpected losses) Strategic acquisition buffer However, given the cost of equity capital and the availability of other funding sources (deposit taking, money markets, debt markets), equity capital is primarily maintained as buffer against risk and for strategic acquisitions.

9. Actual capital is the book value of permanently invested shareholder capital which represents the residual claim on the bank’s net earnings. Equity capital is supplemented by debt Types Capital Internal capital represents risk based capital requirements covering unexpected losses arising from credit, market and operational risks which is calibrated to maintain a level of solvency appropriate for bank’s rating. Strategy & Risk Shareholder EquityReserves Actual Capital Internal CapitalRegulatory Capital Portfolio Regulatory Rules Tier 2 Tier 1 Regulatory capital represents the level of capital which the supervisory authority deem necessary to maintain the solvency of the banking sector. Regulatory capital is now better aligned to bank’s economic capital. Economic & Regulatory Capital = Demand Actual Capital = Supply

10. Internal & Regulatory Capital Business Growth Stress Capital Management Buffer Components of Internal Capital Economic capital - Internal quantitative and aggregated risk estimates for credit, market and operational risks. Management and Strategic Buffer Level of capital that the management deem necessary for: - acquisitions; - business and infrastructure investments; - changes to the legal structure. Capital for Business Growth - Individual business functions will be expected to identify how their capital requirements are anticipated to change over the projected financial year. Capital for Stress Events and Weakness in Risk Analysis -GRC will evaluate stress testing analysis and estimate capital requirements to cover extreme events - Weakness in the EC methodology and general risk management controls would be subject to capital requirements Economic Capital Supervisory Add-ons Pillar 1 Requirements Components of Regulatory Capital Minimum capital requirements to protect the national banking system from the systematic risk contribution of the individual bank. Additional capital deemed appropriate to cover for those risks which are not effectively addressed by the minimum Pillar 1 based capital requirements. Internal and Regulatory Capital are two independent measures of capital requirements.

11. Capital Adequacy Assessment < Total Capital Tier 1 Tier 2 Internal Perspective Pillar 1 Regulatory Capital Total Regulatory Capital Individual Capital Guidance Pillar 1 Regulatory Capital Total Regulatory Capital Add-ons Regulatory Perspective < Total Capital Tier 1 Tier 2 Economic Capital Internal Capital Stress Buffer Mgt Buffer Surplus Internal and Regulatory Capital requirements are compared with actual balance sheet capital. Tier 1 (Core) Capital = Common stock and disclosed reserves (or retained earnings) Tier 2 (Supplementary) Capital = Undisclosed reserves, revaluation reserves, general provisions, hybrid instruments and subordinated term debt Surplus capital over both Internal and Regulatory Capital requirements arises owing to inefficiency from complex legal corporate structure (with multiple balance sheets) and general capital management inefficiencies.

12. Measuring Internal Capital -Economic Capital -Stress Testing -Strategic and Management Buffers

13. Economic Capital Economic Capital - a measure of capital requirements based on the underlying risks faced by the bank. Economic capital is a measure of risk calibrated to reflect the desired level of solvency (external credit rating) and risk horizon (period for which risk is measured – 1 yr in most cases). Economic Capital forms a critical component of the bank’s Internal Capital Requirements, along with the Stress Test Buffer and the Strategic Buffer.

14. Stress Testing and Scenario Analysis Stress Testing and Scenario Analysis are important risk measurement techniques for assessing the impact of extreme but plausible risks. The primary objectives underlying such analysis are: Potential volatility in business performance Adequacy of contingency plans Capacity and capability of management function Adequacy of financial resources Key Deliverables of Stress Test and Scenario Analysis Management understanding and engagement Identifying of business model improvements Identifying adequacy of capital and liquidity resources Stress Testing and Scenario Analysis have assumed critical importance in the current turbulent financial markets and are seen as being a key defining feature of a bank’s internal risk based capital assessment process.

15. Strategic and Management Buffer In addition to the risk based capital requirements (Economic Capital and Stress Test Buffer) most bank’s determine capital for growth and strategic acquisitions. Organic Business Growth – as part of the annual budgeting and planning process balance sheet should be projected from a number of years and in anticipation of this growth certain level of capital should be held. Inorganic Growth – bank’s which use acquisition as a strategic tool need to set aside a certain level of capital for potential acquisitions.

16. Use of Internal Capital - Risk Adjusted Returns & Shareholder Value

17. Shareholder Value Creation Shareholder value is created when actual returns exceed minimum expected returns on invested capital. Minimum expected returns reflect the systemic risk of the organisation. Measuring Value Created Economic Profit =Risk Ad. Returns – Cost of Capital

18. Economic Profit – Prospective & Delivered - Prospective EP = Working Profit Expected Loss Net Capital Charge Tax Charge -- (Working Profit – Expected Loss – Net Capital Charge) × Tax rate% Internal Capital × cost of capital% Total Income – Total Cost - Delivered EP =Working Profit Net Bad Debt Tax Charge --Net Capital Charge (Working Profit – Net Bad Debt – Net Capital Charge) × Tax rate%

19. Internal Capital Allocation Internal Capital need to be allocated or attributed to the individual business functions in proportion to their contribution to the overall risk profile. Some components of Internal Capital are directly attributable to individual business functions (credit, market, operational), while other components (stress buffer) are allocated based on arbitrary rules. Where internal capital is not allocated it is assumed that the group function pays for this. Typically Strategic Management Buffer is paid for by the group function. Group function is also expected to cover the cost of surplus.

20. Cost of Capital – Hurdle Rate Capital Asset Pricing Model (CAPM) is based on the neoclassic portfolio theory which assumes firm specific risk of individual firms does should not concern executive management as investors (shareholders) will diversify away company specific risk through active portfolio management. Under CAPM hurdle rates (cost of capital) are intended to compensate investors for systemic risk (companies beta) of the firm. However, Internal Capital is a firm specific measure of risk; therefore applying CAPM based hurdle rates to EC is mixing two very difference concepts. Most bank’s use a Weighted Average Cost of Capital (WACC) based on an informed view of cost of equity and the cost of debt based on credit rating of the bank. Application of single hurdle rates across all business functions encourages discriminatory behaviour against low-risk business and in favour of high risk ones. Ideally hurdle rates should be set for individual business functions.

21. Individual Capital Adequacy Assessment Process

22. Basel II Framework

23. Pillar 2 ICAAP

24. Supervisory Review – FSA (UK)

25. Concluding Comments

26. Lessons Learnt Executive management need to understand and optimise the risk return of the bank Risk cuts across the organisation and needs to be managed at a holistic level Capital is the last resort risk management tool, management need to be focused on risk governance, monitoring and controls. CEO and his/her direct reports are meant to set the tone from the top with respect to risk culture. Responsibility for ICAAP needs to be equally owned by risk, finance and treasury functions, with appropriate input from the business functions CEO is the owner of the ICAAP An ICAAP is NOT a compliance exercise.