Response to discussion paper on the role of environmental risk in the prudential framework
Go back
ORX is a not-for-profit industry association dedicated to advancing the measurement and management of operational and non-financial risk in the global financial services industry. Please see https://managingrisktogether.orx.org/about for more detail.
Key findings
What additional information would need to be collected in order to understand how environmental risks impact banks’ operational risk?
• Firms are capturing internal environmental risk data and are using a range of additional information such as regulatory publications or data from the Task Force for Climate-Related Financial Disclosures.
• Several members identified a lack of accurate forward-looking data for environmental risks.
What are the practical challenges to identifying environmental risk losses on top of the existing loss event type classification?
• There is a range of practices in identifying and flagging environmental risks.
• Key challenge of differentiating between climate/environmental risks and ‘normal’ weather events.
Additional information requirements
Currently, banks collect internal loss data, particularly for physical risk (e.g., severe weather-related impacts and downtime), for the purposes of operational risk management. Data collection relating to conduct risk (in the context of greenwashing) is also collected but is more scarcely available.
There is an appetite for considering external loss data services such as those provided by ORX (https://managingrisktogether.orx.org/orx-news), to help understand the impact of environmental risk. Historical losses can also help with forward-looking perspectives as historical data can be trended over time to identify patterns. 74 percent of respondents used ORX loss data as an external information source, with 50 percent using ORX Scenarios and 47 percent using data from ORX News.
However, a key challenge that arises is the lack of accurate historical data on environmental risk. As climate-related losses are expected to rise in the coming decade, it is likely that any current historical data may not be representative of potential future losses, which limits its use.
Members also use a wide range of external sources of environmental risk information, including:
Regulatory sources
• Regulatory papers and scenarios
• Central bank supervisory team guidance
• Data from Task Force on Climate-Related Financial Disclosures (TCFD)
• Data from UNPRI (UN Principles for Responsible Investment)
Other sources
• Academic climate research
• Environmental risk geo-localization
• Natural hazard/catastrophe databases provided by insurers
• External consultancy climate models
• Market sentiment indicators
Practical challenges of identifying environmental losses
Environmental flags
The majority (69 percent) of respondents have, or plan to have, an environmental risk flag for operational risk loss events. This was greater than the 50 percent of firms that have, or plan to have, an environmental risk flag for credit risk events.
There is currently limited industry consistency in the definitions used for climate/environment related risks, including naming conventions and scope. Members report a range of names for the flag and a range of associated definitions for these flag names. A third of respondents use the term ‘ESG risk’ for the flag (which can include events wider than climate/environment), whilst another third uses the term ‘Climate risk’. A further 17 percent of firms used the term ‘Environmental risk’ as the flag, with the remainder using a range of different terms.
In terms of capturing internal events, 62 percent of firms have or plan to have a formal process for allocating an environmental risk flag to loss events.
Members are taking a variety of approaches to identifying environmental risks. This is a fast-changing area of risk identification, and there are several key challenges:
• For members with a process for allocating an environmental risk flag to loss events, one approach is for the first line to capture environmental risk as a driver of existing loss event types. This determines the allocation of an environmental flag.
• Several members that plan to introduce a process highlighted the challenge of differentiation between normal weather events and climate risk e.g., rainfall as a normal natural event and rainfall as climate risk event. This challenge was also raised in the ORX Climate Approach paper.
• One approach is to identify ESG data through pre-defined text searches in conjunction with queries, potentially using AI tools, rather than using a flag to tag relevant losses.
• Other members planning to introduce a process said that specific regulatory guidance across Environment, Social and Governance categories would be useful in developing an approach within the firm. Standardisation by industry bodies such as ORX would also be helpful.
Environmental risk categorisation
Categorisation of environmental risks is an evolving area. There is currently a range of practice within firms, with some firms treating environmental risks as an event type, and some firms treating environmental factors as a causal factor giving rise to other event types. Banks typically have an environmental risk category defined within their operational risk event taxonomies (approx. 60 percent reported as already defining or planning to define this as a risk event). With regards to causal taxonomies, nearly 70 percent of banks reported either having, or planning to introduce, an environmental risk category within such taxonomies.
Following previous discussions with members, ORX has suggested that climate should be considered as a causal factor of a range of operational risks, rather than as a discrete event type. As a result, ORX has recommended that rather than having a discrete ‘climate’ event type, environmental risk would be broken down into several existing event types (see the ORX Reference Taxonomy for operational risk https://managingrisktogether.orx.org/operational-risk-taxonomy). This included in particular transition and physical risk events (https://managingrisktogether.orx.org/sites/default/files/public/downloads/2022/07/climateoperationalrisk-theorxapproach.pdf).
There was a range of practices reported with respect to the exact mechanism of classifying environmental risk within event taxonomies. Some of the ways in which this was done included categorised environmental risk under L1 ESG-related risk umbrella, on a L2 level alongside “social risks”, “workplace safety risks”. Sometimes, environmental risk is included alongside a broader set of NFR risks.
In terms of some of the key challenges around environment risk classification:
• Alignment on whether to treat environmental risk as a cause or as a separate event. There remain significant differences in terms of the way this is treated across firms, and therefore in the way in which environmental risk is measured and monitored.
• Firms report a range of practices with respect to classification of environmental risks. There is space for additional guidance in the area so as to encourage best practice. For example, some firms report only focusing on ‘greenwashing’ risk (ORX identified this as a ‘transition’ risk event), whereas others only focus on the physical risk events (e.g., ‘natural disasters’). ORX will explore opportunities to develop further guidance with members to ensure firms have sufficiently robust classification of environmental risk to capture all possible related events.
Key findings
What is your view on potential integration of a forward-looking perspective into the operational risk framework to account for the increasing severity and frequency of physical environmental events?
• Majority of members have a physical environmental risk scenario for regulatory capital.
What are the theoretical and practical challenges of introducing such a perspective in the Standardised Approach?
• Forward-looking data over the time horizon required by regulators is not available.
• The Standardised Approach (Basel III) is not designed to have a forward-looking capability.
Views on the potential integration of a forward-looking perspective into the operational risk framework
The majority (74 percent) of members that responded have one or more scenarios for physical environmental risks, and some members (43 percent) also have operational risk scenarios for transition risks.
Members commented that risk sensitivity and forward-looking capability are the two limitations of the current SMA design. For a forward-looking capability to be included in the standardised approach, this would require the incorporation of projections of future losses from environmental risk factors, not just historical losses (which would raise the question of why other loss-triggering factors should not be similarly incorporated into projections for other event types). Commonly used scenarios for considering climate change impacts include the 'hot house world' or ‘two degrees centigrade temperature rise’ scenarios. The impacts of these scenarios are likely to play out over a longer timeframe. Modelling these impacts would therefore require reliable forward projections. A forward-looking capability would also require the effective 'front-loading' of operational risk capital requirements against events possibly taking place at some relatively distant time in the future. The last two challenges are particularly relevant for incorporating physical risk impacts.
Theoretical and practical challenges of introducing a forward-looking perspective in the Standardised Approach
The DP is a welcome effort to provide additional regulatory clarity. However, members do note a number of challenges around the requirements for environmental risks. There is an inherent challenge in modelling physical events, due in part because historical physical events do not necessarily accurately reflect future potential risk.
A challenge specific to the regulatory framework is that for environmental risks typical time horizons are longer-term, and may not align with the measurement of risk over a 1-year time horizon.
Providing accurate data and reasonable forecasts of future conditions is challenging and observations were raised:
• Members identify that it is challenging to quantify risks where there is limited data, and the nature of the risk is evolving (assessing both the probability and severity of such future events is difficult).
• Forward-looking perspectives are based on science and climate data from national scientific bodies, but supporting data is often estimated and approximated. Continuous work is done to secure accurate data and to reasonably forecast impacts the medium and long-term.
• Models, data and methodologies are divergent across data providers, third parties and peers. This could lead to a wide variation in capital charges between two firms with similar exposures.
• Existing adverse weather scenarios capture much of the same loss impacts that a severe physical event would present. How do you make it more severe (other than potentially increasing frequency and/or length of event) to account for a climate-related loss?
• For a predominantly UK-based group, the possible length of time before severe physical impacts become apparent makes it impractical to ask SMEs to create estimates or even storylines.
Risk management challenges:
• It is difficult to draw actionable conclusions from the operational risk data related to environmental events.
• Transition risk is itself evolving and exposures are dynamic – meaning disclosures made today may be deemed unacceptable in the future. As a result, there is the potential for this risk type to become more severe over time.
Key findings
• Consensus that the impact of environmental risk on strategic and reputational risk should stay in Pillar 2.
A consensus formed among the majority of banks surveyed, indicating that environmental risk factor impacts should remain under the scope of Pillar 2, with respect to strategic and reputational risk impacts. 74 percent of respondents agreed that the impact of environmental risk factors on strategic and reputational risk should remain in Pillar 2. Four percent of firms disagreed. For the remaining 22 percent of respondents, the firms responded that this was not currently applicable in their jurisdiction.
Respondents perceived Pillar 2 as granting additional abilities to use qualitative assessments (beyond quantitative assessments used for Pillar 1). This is especially the case for reputation risk, which can be difficult to quantify due to the large number of contributory factors and indicators that may vary by firm.
Additionally, it was underlined that environmental risk quantification into specific financial loss estimates is still in its infancy, and therefore precludes institutions from including one e.g., climate change scenario analysis within Pillar 1 capital requirements calculations.
As summarized in the EBA paper, Basel IV SMA is not designed to give this perspective. However, this applies to all OR risks, not just the environmentally driven ones. A simpler approach was decided at the Basel level after the sub-optimal experience with more complex approaches in the previous framework. Therefore, the Pillar I SMA is accompanied by sound OR management in Pillar II. It is believed that any specific treatment of ESG risks should become / remain part of the Pillar 2 framework.
The following proposals were made by members for integrating environmental risks into the operational risk framework. These proposals will be considered for the ORX workplan for climate and environmental risks.
• Establishing a common language amongst regulators and peer firms – agreeing when an environmental risk should be capturing, ensuring common definitions. For example, providing guidance on the areas of overlap and divergence between ‘environmental’ and ‘climate’ risks.
• Sharing of best practice in terms of operational risk frameworks – considering whether the traditional risk tools (RCSAs/Scenarios) are fit for purpose for measuring and managing environmental risks.
• Creating alignment and consistency on how firms should consider risks, think about scenarios, and make decisions on data and methodological choices. It would also be helpful to codify that climate risks are drivers of other risks versus standalone operational risks.
• Integration with other regulatory work on resiliency.
ORX values the opportunity to respond to the European Banking Authority’s discussion paper on ‘The role of environmental risks in the prudential framework (EBA DP 2022/02)’. Our response focuses on the operational risk aspects of the paper (questions 26-29) and is informed by feedback from a survey of our membership (https://managingrisktogether.orx.org/orx-membership/map), and our “Climate & Operational Risk: the ORX Approach” paper (https://managingrisktogether.orx.org/news-blogs-updates/climate-operational-risk-orx-approach). Our contribution is summarised below:
A timely overview of environmental risk regulatory requirements: The EBA’s paper provides a welcome stock-take of requirements for identifying environmental risks. The majority of ORX survey respondents are already modelling environmental impacts with a physical environmental risk scenario, and the majority also have or plan to have a flag for identifying environmental risks (in line with the approach developed by ORX with our membership) – although there is a range of practice in both areas. There was strong consensus around retaining the impact of environmental risk factors on strategic and reputational risk under the scope of the Pillar 2 framework.
Challenges in data and language: Many members identified the challenges of including a forward-looking perspective in the BCBS Standardised Approach, the difficulty in obtaining good quality data on environmental risks that is applicable to potential losses in the future, and the need for a common language for firms and regulators in identifying environmental risks.
At ORX we will continue to work with our members on the identification of environmental risks. ORX is very happy to discuss with the EBA any of the points outlined in this letter.
Yours sincerely,
Steve Bishop, Research and Information Director, ORX
steve.bishop@orx.org
Q26: What additional information would need to be collected in order to understand how environmental risks impact banks’ operational risk? What are the practical challenges to identifying environmental risk losses on top of the existing loss event type classification?
This response is made by ORX (https://managingrisktogether.orx.org) on behalf of our members (https://managingrisktogether.orx.org/orx-membership/map) and represents member views gathered via survey.ORX is a not-for-profit industry association dedicated to advancing the measurement and management of operational and non-financial risk in the global financial services industry. Please see https://managingrisktogether.orx.org/about for more detail.
Key findings
What additional information would need to be collected in order to understand how environmental risks impact banks’ operational risk?
• Firms are capturing internal environmental risk data and are using a range of additional information such as regulatory publications or data from the Task Force for Climate-Related Financial Disclosures.
• Several members identified a lack of accurate forward-looking data for environmental risks.
What are the practical challenges to identifying environmental risk losses on top of the existing loss event type classification?
• There is a range of practices in identifying and flagging environmental risks.
• Key challenge of differentiating between climate/environmental risks and ‘normal’ weather events.
Additional information requirements
Currently, banks collect internal loss data, particularly for physical risk (e.g., severe weather-related impacts and downtime), for the purposes of operational risk management. Data collection relating to conduct risk (in the context of greenwashing) is also collected but is more scarcely available.
There is an appetite for considering external loss data services such as those provided by ORX (https://managingrisktogether.orx.org/orx-news), to help understand the impact of environmental risk. Historical losses can also help with forward-looking perspectives as historical data can be trended over time to identify patterns. 74 percent of respondents used ORX loss data as an external information source, with 50 percent using ORX Scenarios and 47 percent using data from ORX News.
However, a key challenge that arises is the lack of accurate historical data on environmental risk. As climate-related losses are expected to rise in the coming decade, it is likely that any current historical data may not be representative of potential future losses, which limits its use.
Members also use a wide range of external sources of environmental risk information, including:
Regulatory sources
• Regulatory papers and scenarios
• Central bank supervisory team guidance
• Data from Task Force on Climate-Related Financial Disclosures (TCFD)
• Data from UNPRI (UN Principles for Responsible Investment)
Other sources
• Academic climate research
• Environmental risk geo-localization
• Natural hazard/catastrophe databases provided by insurers
• External consultancy climate models
• Market sentiment indicators
Practical challenges of identifying environmental losses
Environmental flags
The majority (69 percent) of respondents have, or plan to have, an environmental risk flag for operational risk loss events. This was greater than the 50 percent of firms that have, or plan to have, an environmental risk flag for credit risk events.
There is currently limited industry consistency in the definitions used for climate/environment related risks, including naming conventions and scope. Members report a range of names for the flag and a range of associated definitions for these flag names. A third of respondents use the term ‘ESG risk’ for the flag (which can include events wider than climate/environment), whilst another third uses the term ‘Climate risk’. A further 17 percent of firms used the term ‘Environmental risk’ as the flag, with the remainder using a range of different terms.
In terms of capturing internal events, 62 percent of firms have or plan to have a formal process for allocating an environmental risk flag to loss events.
Members are taking a variety of approaches to identifying environmental risks. This is a fast-changing area of risk identification, and there are several key challenges:
• For members with a process for allocating an environmental risk flag to loss events, one approach is for the first line to capture environmental risk as a driver of existing loss event types. This determines the allocation of an environmental flag.
• Several members that plan to introduce a process highlighted the challenge of differentiation between normal weather events and climate risk e.g., rainfall as a normal natural event and rainfall as climate risk event. This challenge was also raised in the ORX Climate Approach paper.
• One approach is to identify ESG data through pre-defined text searches in conjunction with queries, potentially using AI tools, rather than using a flag to tag relevant losses.
• Other members planning to introduce a process said that specific regulatory guidance across Environment, Social and Governance categories would be useful in developing an approach within the firm. Standardisation by industry bodies such as ORX would also be helpful.
Environmental risk categorisation
Categorisation of environmental risks is an evolving area. There is currently a range of practice within firms, with some firms treating environmental risks as an event type, and some firms treating environmental factors as a causal factor giving rise to other event types. Banks typically have an environmental risk category defined within their operational risk event taxonomies (approx. 60 percent reported as already defining or planning to define this as a risk event). With regards to causal taxonomies, nearly 70 percent of banks reported either having, or planning to introduce, an environmental risk category within such taxonomies.
Following previous discussions with members, ORX has suggested that climate should be considered as a causal factor of a range of operational risks, rather than as a discrete event type. As a result, ORX has recommended that rather than having a discrete ‘climate’ event type, environmental risk would be broken down into several existing event types (see the ORX Reference Taxonomy for operational risk https://managingrisktogether.orx.org/operational-risk-taxonomy). This included in particular transition and physical risk events (https://managingrisktogether.orx.org/sites/default/files/public/downloads/2022/07/climateoperationalrisk-theorxapproach.pdf).
There was a range of practices reported with respect to the exact mechanism of classifying environmental risk within event taxonomies. Some of the ways in which this was done included categorised environmental risk under L1 ESG-related risk umbrella, on a L2 level alongside “social risks”, “workplace safety risks”. Sometimes, environmental risk is included alongside a broader set of NFR risks.
In terms of some of the key challenges around environment risk classification:
• Alignment on whether to treat environmental risk as a cause or as a separate event. There remain significant differences in terms of the way this is treated across firms, and therefore in the way in which environmental risk is measured and monitored.
• Firms report a range of practices with respect to classification of environmental risks. There is space for additional guidance in the area so as to encourage best practice. For example, some firms report only focusing on ‘greenwashing’ risk (ORX identified this as a ‘transition’ risk event), whereas others only focus on the physical risk events (e.g., ‘natural disasters’). ORX will explore opportunities to develop further guidance with members to ensure firms have sufficiently robust classification of environmental risk to capture all possible related events.
Q27: What is your view on potential integration of a forward-looking perspective into the operational risk framework to account for the increasing severity and frequency of physical environmental events? What are the theoretical and practical challenges of introducing such a perspective in the Standardised Approach?
This response is made by ORX (https://managingrisktogether.orx.org) on behalf of our members (https://managingrisktogether.orx.org/orx-membership/map) and represents member views gathered via survey.Key findings
What is your view on potential integration of a forward-looking perspective into the operational risk framework to account for the increasing severity and frequency of physical environmental events?
• Majority of members have a physical environmental risk scenario for regulatory capital.
What are the theoretical and practical challenges of introducing such a perspective in the Standardised Approach?
• Forward-looking data over the time horizon required by regulators is not available.
• The Standardised Approach (Basel III) is not designed to have a forward-looking capability.
Views on the potential integration of a forward-looking perspective into the operational risk framework
The majority (74 percent) of members that responded have one or more scenarios for physical environmental risks, and some members (43 percent) also have operational risk scenarios for transition risks.
Members commented that risk sensitivity and forward-looking capability are the two limitations of the current SMA design. For a forward-looking capability to be included in the standardised approach, this would require the incorporation of projections of future losses from environmental risk factors, not just historical losses (which would raise the question of why other loss-triggering factors should not be similarly incorporated into projections for other event types). Commonly used scenarios for considering climate change impacts include the 'hot house world' or ‘two degrees centigrade temperature rise’ scenarios. The impacts of these scenarios are likely to play out over a longer timeframe. Modelling these impacts would therefore require reliable forward projections. A forward-looking capability would also require the effective 'front-loading' of operational risk capital requirements against events possibly taking place at some relatively distant time in the future. The last two challenges are particularly relevant for incorporating physical risk impacts.
Theoretical and practical challenges of introducing a forward-looking perspective in the Standardised Approach
The DP is a welcome effort to provide additional regulatory clarity. However, members do note a number of challenges around the requirements for environmental risks. There is an inherent challenge in modelling physical events, due in part because historical physical events do not necessarily accurately reflect future potential risk.
A challenge specific to the regulatory framework is that for environmental risks typical time horizons are longer-term, and may not align with the measurement of risk over a 1-year time horizon.
Providing accurate data and reasonable forecasts of future conditions is challenging and observations were raised:
• Members identify that it is challenging to quantify risks where there is limited data, and the nature of the risk is evolving (assessing both the probability and severity of such future events is difficult).
• Forward-looking perspectives are based on science and climate data from national scientific bodies, but supporting data is often estimated and approximated. Continuous work is done to secure accurate data and to reasonably forecast impacts the medium and long-term.
• Models, data and methodologies are divergent across data providers, third parties and peers. This could lead to a wide variation in capital charges between two firms with similar exposures.
• Existing adverse weather scenarios capture much of the same loss impacts that a severe physical event would present. How do you make it more severe (other than potentially increasing frequency and/or length of event) to account for a climate-related loss?
• For a predominantly UK-based group, the possible length of time before severe physical impacts become apparent makes it impractical to ask SMEs to create estimates or even storylines.
Risk management challenges:
• It is difficult to draw actionable conclusions from the operational risk data related to environmental events.
• Transition risk is itself evolving and exposures are dynamic – meaning disclosures made today may be deemed unacceptable in the future. As a result, there is the potential for this risk type to become more severe over time.
Q28: Do you agree that the impact of environmental risk factors on strategic and reputational risk should remain under the scope of the Pillar 2 framework?
This response is made by ORX (https://managingrisktogether.orx.org) on behalf of our members (https://managingrisktogether.orx.org/orx-membership/map) and represents member views gathered via survey.Key findings
• Consensus that the impact of environmental risk on strategic and reputational risk should stay in Pillar 2.
A consensus formed among the majority of banks surveyed, indicating that environmental risk factor impacts should remain under the scope of Pillar 2, with respect to strategic and reputational risk impacts. 74 percent of respondents agreed that the impact of environmental risk factors on strategic and reputational risk should remain in Pillar 2. Four percent of firms disagreed. For the remaining 22 percent of respondents, the firms responded that this was not currently applicable in their jurisdiction.
Respondents perceived Pillar 2 as granting additional abilities to use qualitative assessments (beyond quantitative assessments used for Pillar 1). This is especially the case for reputation risk, which can be difficult to quantify due to the large number of contributory factors and indicators that may vary by firm.
Additionally, it was underlined that environmental risk quantification into specific financial loss estimates is still in its infancy, and therefore precludes institutions from including one e.g., climate change scenario analysis within Pillar 1 capital requirements calculations.
As summarized in the EBA paper, Basel IV SMA is not designed to give this perspective. However, this applies to all OR risks, not just the environmentally driven ones. A simpler approach was decided at the Basel level after the sub-optimal experience with more complex approaches in the previous framework. Therefore, the Pillar I SMA is accompanied by sound OR management in Pillar II. It is believed that any specific treatment of ESG risks should become / remain part of the Pillar 2 framework.
Q29: Do you have any other proposals on integrating environmental risks within the operational risk framework?
This response is made by ORX (https://managingrisktogether.orx.org) on behalf of our members (https://managingrisktogether.orx.org/orx-membership/map) and represents member views gathered via survey.The following proposals were made by members for integrating environmental risks into the operational risk framework. These proposals will be considered for the ORX workplan for climate and environmental risks.
• Establishing a common language amongst regulators and peer firms – agreeing when an environmental risk should be capturing, ensuring common definitions. For example, providing guidance on the areas of overlap and divergence between ‘environmental’ and ‘climate’ risks.
• Sharing of best practice in terms of operational risk frameworks – considering whether the traditional risk tools (RCSAs/Scenarios) are fit for purpose for measuring and managing environmental risks.
• Creating alignment and consistency on how firms should consider risks, think about scenarios, and make decisions on data and methodological choices. It would also be helpful to codify that climate risks are drivers of other risks versus standalone operational risks.
• Integration with other regulatory work on resiliency.
Any other comments?
Dear Sir or Madam,ORX values the opportunity to respond to the European Banking Authority’s discussion paper on ‘The role of environmental risks in the prudential framework (EBA DP 2022/02)’. Our response focuses on the operational risk aspects of the paper (questions 26-29) and is informed by feedback from a survey of our membership (https://managingrisktogether.orx.org/orx-membership/map), and our “Climate & Operational Risk: the ORX Approach” paper (https://managingrisktogether.orx.org/news-blogs-updates/climate-operational-risk-orx-approach). Our contribution is summarised below:
A timely overview of environmental risk regulatory requirements: The EBA’s paper provides a welcome stock-take of requirements for identifying environmental risks. The majority of ORX survey respondents are already modelling environmental impacts with a physical environmental risk scenario, and the majority also have or plan to have a flag for identifying environmental risks (in line with the approach developed by ORX with our membership) – although there is a range of practice in both areas. There was strong consensus around retaining the impact of environmental risk factors on strategic and reputational risk under the scope of the Pillar 2 framework.
Challenges in data and language: Many members identified the challenges of including a forward-looking perspective in the BCBS Standardised Approach, the difficulty in obtaining good quality data on environmental risks that is applicable to potential losses in the future, and the need for a common language for firms and regulators in identifying environmental risks.
At ORX we will continue to work with our members on the identification of environmental risks. ORX is very happy to discuss with the EBA any of the points outlined in this letter.
Yours sincerely,
Steve Bishop, Research and Information Director, ORX
steve.bishop@orx.org