Banks and pandemic risk part II: How well prepared was the banking sector?

11 augustus, 2020 - Joost Busch,

In Part 1 of our blog series about pandemic risk, we portrayed the situation prior to the current Covid-19 crisis. The current pandemic does not seem to be the ‘black swan’ event some make it out to be. This raised the question: Could banks have seen this coming? And if so, how well did they prepare? Spoiler alert: We have found some interesting insights!

To start off we have interviewed several risk experts from Dutch banks as well as insurance companies, to learn more about high-impact tail events, commonly described as ‘catastrophic risk events’. This type of risk is generally being assessed based on scenario analysis methods in which the “0,01% likelihood events” are identified.  We will come back on that in more detail later. Whilst shedding a light on this matter, we’ll make the distinction between risk management and crisis management. Lastly, we’ll make the comparison with the insurance sector, which takes a very different approach to extreme uncertainties.


Pandemic risk as part of operational risk

Although a pandemic has a significant effect on financial risk types like credit risk and market risk, the responsibility for managing an external event like a pandemic should be governed under the definition of operational risk.  A pandemic risk event negatively affects the core processes and goals of a bank. Consequently, a bank or insurance company requires an adequate amount of Operational Risk capital in place to overcome such an occurrence. With respect to banks, the Basel Framework has provided several measurement approaches, varying in levels of complexity, for calculating operational risk capital. As this lead to a general lack of comparability in the way banks calculated their risk capital due to the construction of complex internal models, these so-called Advanced Measurement models are being replaced by the Standard Measurement Approach (SMA) under Basel III, which will be further developed under Basel IV. 

An advantage of the SMA approach comes with its simplicity and comparability. However, critics of this approach have stipulated that it might be too backward looking, by not taking into account emerging or future risks (Vickers, 2018). Most banks use scenario analysis to predict and adhere to future unexpected risks and to calculate capital reserves. Our conversations with Risk Managers leads us to believe that banks rely too heavily on external loss databases, loss events and own expertise. This is in line with the work of Dutta and Babbel (2012) and Rosengren (2006), who mention that the use of scenario analysis in calculating operational risk capital can be too arbitrary and therewith often inaccurate.


Risk management vs crisis management

To fully capture the extent to which the banking and insurance sectors were prepared for a pandemic, we need to not only look at risk management but also crisis management preparations. Before we do so, we need to understand the difference between risk management and crisis management.   

Risk management is about identifying, assessing and mitigating risks impacting organizational goals.  Crisis management is concerned with managing the actual aftermath of the risk event and responding to and recovering from an unforeseen major event. When we discuss about pandemic risk both areas of expertise are equally important. As discussed in the previous section, managing pandemic risk with the current tools and operational risk measurement approach put forward by Basel III – like the SMA approach -  don’t adequately capture this risk, as it tends to focus primarily on calculations based on banks’ internal loss experience from the past. Hence, several banking institutions such as Bank of International Settlements (BIS), the European Central Bank (ECB) and De Nederlandsche Bank (DNB) have called upon banks to have profound crisis management strategies, such as Business Continuity Plans in place. This would still pose the question if banks should focus more on Risk Management surrounding very unlikely events and subsequently hold additional capital for these risks.   


Banks versus insurance companies

Interestingly, insurance companies take a very different approach than banks in mitigating and managing extreme unlikely events, such as pandemics. In many cases the risk is transferred to a reinsurance company using Insurance Linked Securities (ILS) like catastrophic bonds (CAT bonds), which pay out in case of an unlikely event, like a pandemic. Where it did not seem to be on top of the priority list for banks, it was actually the number one feared extreme event for insurance companies in 2013 (Artemis, 2013). Furthermore, the fact that this kind of risk is reinsured means that they are, in some way, quantifiable. Of course, banks and insurance companies differ a great deal and the impact of catastrophic events is usually more severe for insurance companies, risking a huge unexpected payout and subsequent drop in solvency. However, banks could and should still try to learn from the way insurance companies are measuring and modelling these types of extreme event risks.


In short

Eventhough the Covid-19 pandemic is an extraordinary event, this crisis shows the vulnerabilities of current risk management practices. Hopefully it will wake up banks and regulators to become more forward looking in their risk management processes, specifically with regards to scenario analysis. When asking risk managers from a number of Dutch banks about if they would treat pandemic risk differently after the current crisis, they all answered: “yes”, admitting that they might have underestimated either the likelihood or the severity of such an event after all.