Managing Spreadsheets for CCAR and DFAST Compliance

Transcription

1 Managing Spreadsheets for CCAR and DFAST Compliance White Paper Incisive Software Corporation 300 Santana Row, Suite 200 San Jose, CA

2 EXECUTIVE SUMMARY The United States Federal Comprehensive Capital Analysis and Review (CCAR) and Dodd-Frank Act Stress Test (DFAST) create new challenges in spreadsheet risk management for the nation s largest bank holding companies (BHCs). A large portion of any BHC s financial data resides in spreadsheets. These spreadsheets are scattered across the organization and exist in various states of completeness and accuracy. Yet CCAR and DFAST testing depends on these spreadsheets being complete, accurate, and closely managed. BHCs need a solution for: Spreadsheet discovery, so they can be certain they have identified all spreadsheets relevant to stress tests. Spreadsheet accuracy, so they can be certain that spreadsheets are up-to-date and error-free. Spreadsheet auditability, so they can identify data sources and track ongoing edits. Simulation support, so they can run complex spreadsheet simulations easily. Operational agility and cost-effectiveness, so that manual processes involving spreadsheets do not slow down the compliance team or escalate labor costs. Incisive Software has developed a spreadsheet analysis and management solution that meets enterprise requirements for spreadsheet risk management, analysis, and control and that helps financial institutions facilitate and demonstrate compliance with CCAR, DFAST, and other industry regulations. The solution features three applications: Concourse, a collaboration and control environment for spreadsheets. Locator, a solution for finding all spreadsheets under management. Xcellerator, a powerful error-checking application that overlays Excel spreadsheets with detailed cautions and alerts. Using the Incisive solution, BHCs can: Discover all spreadsheets relevant to CCAR and DFAST. Implement access controls for spreadsheets once they are found. Ensure stress-test data is accurate. Track changes in spreadsheets down to the cell level in real time. Demonstrate compliance with detailed audit trails. Reduce compliance labor costs and promote operational agility. For more information about the Incisive solution for spreadsheet management, please visit or call +1 (408)

3 ACCURACY IN CCAR AND DFAST DEPENDS ON SPREADSHEETS The United States Federal Comprehensive Capital Analysis and Review (CCAR) and Dodd-Frank Act Stress Test (DFAST) create new challenges in spreadsheet risk management for the nation s largest bank holding companies (BHCs). Regulated by the Federal Reserve Board (FRB), CCAR and DFAST are designed to determine whether BHCs with $50 billion or more in consolidated assets have effective capital adequacy processes and sufficient capital to absorb losses during stressful conditions, while meeting obligations to creditors and counterparties and continuing to serve as credit intermediaries. According to the FRB: And: The Comprehensive Capital Analysis and Review (CCAR) evaluates a BHC s capital adequacy, capital adequacy process, and planned capital distributions, such as dividend payments and common stock repurchases. As part of CCAR, the Federal Reserve evaluates whether BHCs have sufficient capital to continue operations throughout times of economic and financial market stress and whether they have robust, forward-looking capital-planning processes that account for their unique risks.... Dodd-Frank Act supervisory stress testing [DFAST] is a forward-looking quantitative evaluation of the impact of stressful economic and financial market conditions on BHC capital. This program serves to inform these financial companies, as well as the general public, how the institutions capital ratios might change during a hypothetical set of adverse economic conditions as designed by the Federal Reserve. In addition to the annual supervisory stress test conducted by the Federal Reserve, each BHC is required to conduct annual company-run stress tests under the same supervisory scenarios and conduct a mid-cycle stress test under company-developed scenarios. 1 As PricewaterhouseCoopers notes, The primary difference between DFAST and CCAR is that CCAR includes the BHC s submission of proposed capital actions and the Fed s object or non-object determination. Capital actions under DFAST are standardized base on the BHC's existing dividend payout rate. 2 What both tests have in common is that they require massive amounts of work from BHCs. That work includes collecting, analyzing, correcting, and sharing financial information from all parts of the organization. In any large organization, and certainly in BHCs, a large portion of important financial data and financial models resides in spreadsheets. These spreadsheets are scattered across the organization. The people who created the spreadsheets might not be the people maintaining them. Misunderstandings can occur. Omissions can occur. Spreadsheet formulas might be subtly incorrect. Yet for CCAR and DFAST testing, and indeed for sound business management, the completeness and accuracy of all these spreadsheets are paramount

4 CHALLENGES WITH SPREADSHEET REPORTING FOR CCAR AND DFAST The challenges involved in managing spreadsheets for CCAR and DFAST are considerable. They include the following: Discovery In any organization with tens or hundreds of thousands of employees, finding spreadsheets can be a challenge. BHCs are no exception. They need an automated search and discovery solution to find all the spreadsheets needed for CCAR and DFAST. Accuracy Once a BHC identifies and collects all its relevant spreadsheets, it needs a systematic way of ensuring that their data and their formulas are accurate. Have there been errors in data entry? Have formulas changed? Have some data sources become obsolete? To understand the true state of the BHC s finances, these questions must be answered. But answering them can be a time-intensive endeavor. Whenever possible, the accuracy of spreadsheet data should be verified through automation. Auditability As it collects and manages spreadsheet data, the BHC needs to maintain an audit trail so managers and compliance officers can understand where the data is coming from, who has entered it or changed it, and when changes were made. Auditability also helps the BHC manage its own internal processes more effectively. Simulation support Stress testing requires simulations and what-if scenarios, and these in turn depend on data models, some of which might be created specifically for CCAR and DFAST. However the BHC manages its spreadsheets, it must ensure it has a systematic approach for supporting stress tests and other types of simulations and modeling. Agility and cost The more manual a process is, the longer it takes and the more error-prone it will be. Agility for organizations as large as BHCs requires IT automation, whenever possible. Without an automated solution, collecting, reviewing, and correcting spreadsheets, data collection and analysis for CCAR and DFAST will be time-consuming and expensive. Other the hand, if managing spreadsheets becomes easy, then BHCs and other institutions can engage in stress tests and other simulations whenever needed. To address these challenges, BHC s need a spreadsheet risk management solution that brings visibility and control to the collection and management of spreadsheets, even for the largest of BHCs. THE INCISIVE SOLUTION FOR SPREADSHEET RISK MANAGEMENT Incisive Software has developed a spreadsheet analysis and management solution that meets enterprise requirements for spreadsheet risk management, analysis, and control and that helps financial institutions facilitate and demonstrate compliance with CCAR, DFAST, and other industry regulations. The Incisive solution is a flexible, scalable solution built on three specialized applications: - 4 -

5 Concourse A collaboration and control environment for all users involved in the creation, maintenance, and auditing of critical spreadsheets, Concourse enables compliance teams and other financial professionals to work together efficiently as they collect and assess spreadsheet data for stress tests, with robust reporting on who did what, when. Compliance officers and others can monitor changes down to the cell level with Concourse alerts. Configurable alerts can be sent via , an RSS feed, or both. Alerts can be configured to activate on cell value or percentage, cell calculation value or percentage, formula change, formula reference, as well as row and column insert/delete/move changes. Concourse also enables spreadsheet users to compare spreadsheet versions and quickly understand differences, a feature that is particularly useful for simulations and forecasting. Locator Stress tests depend on complete and accurate data. Locator finds all the spreadsheets needed for stress tests and other financial operations. Xcellerator Powerful error checking and investigative features in Xcellerator enable users to find and fix even the subtlest errors in the largest spreadsheets. Xcellerator s sophisticated logic is completely independent of Excel and delivers higher-level functionality and unprecedented accuracy. Unlike other spreadsheet error detection applications, Xcellerator and Excel seamlessly appear as one to the user, while the integrity of the spreadsheet application is always maintained. Incisive s patent-pending heat map technology displays an overlay of detailed cautions and alerts while preserving the integrity of spreadsheets themselves. Xcellerator helps organizations have confidence in the integrity of their spreadsheet data. APPLYING THE INCISIVE SOLUTION TO STRESS TESTS Together, these Incisive applications enable enterprises to meet the challenges of managing spreadsheets for stress tests. Using Incisive, BHCs can: Discover all the spreadsheets relevant to CCAR and DFAST. Using Locator, compliance officers and others can locate all the spreadsheets needed for stress tests and other financial activities. Implement access controls for spreadsheets once they are found. Using Concourse, BHCs can enforce access controls on spreadsheets and ensure that only authorized employees have access to them. They can also track versions and ensure that departments and divisions are not operating from unmanaged variants of critical spreadsheets. Ensure stress-test data is accurate. Using Xcellator, spreadsheet users can scan spreadsheets for almost 40 areas of risk to catch errors early. Compliance officers can give their Board of Directors confidence that capital plans and other submissions to the Federal Reserve are accurate. Track changes. Compliance officers can keep apprised of spreadsheet changes even down to the cell level through Concourse alerts. They can also compare spreadsheets and identify differences quickly and accurately. Support stress-test simulations. Incisive enables spreadsheet users to develop a simulation in a certain direction and easily backtrack to the simulation s beginning if the simulation turns out not to be appropriate or fruitful

6 Demonstrate compliance. The Incisive solution provides an audit trail of all changes to spreadsheets. It also helps institutions demonstrate that they have a rigorous process for locating and managing all critical spreadsheets. Reduce costs and promote agility. The Incisive solution improves efficiencies and saves time, allowing the BHC to collect data, run simulations, and conduct stress tests whenever needed. Through its automation, the Incisive solution has been found to reduce a staff-day of spreadsheet inspection work to 15 minutes. The Incisive solution is a controlled collaborative environment that provides workflow automation and version control with check-in and check-out of spreadsheets. Incisive brings visibility, control, and automation to what otherwise can be a daunting, labor-intensive process. SIGNATURE BANK AND SPREADSHEET RISK MANAGEMENT Signature Bank (NASDAQ: SBNY) is a full-service commercial bank with offices in the five boroughs of New York City, as well as Nassau, Suffolk and Westchester counties. Smaller than a BHC but growing rapidly, Signature Bank sought a spreadsheet risk management solution for collecting and analyzing spreadsheets for DFAST compliance as well as for strategic planning. Challenge Signature Bank was manually validating spreadsheets containing complex models, including models used for DFAST compliance. The bank wanted to upgrade and automate this process and to create controls and reporting capabilities for all spreadsheets, down to the user level. Why Signature Bank Chose Incisive Signature Bank chose the Incisive solution for spreadsheet risk management for the following reasons: Ability to control roles and permissions for all spreadsheet users in the organization. Easily track changes and version control with a thorough audit trail. Support for ad hoc workflows while maintaining security and auditability. Ability to create a global inventory of spreadsheets and to locate spreadsheets with customer data such as Social Security numbers. Results Using the Incisive solution for spreadsheet risk management, Signature has realized the following benefits: Reduced time required for validating financial models. Automated spreadsheet inventory and the profiling of spreadsheet risks. Increased confidence in spreadsheet data. Implemented controls and reporting for transparent and accurate spreadsheet data. CONCLUSION CCAR and DFAST are intended to help BHCs reduce risk in their business strategies and daily operations. By implementing the Incisive solution for spreadsheet risk management to comply with CCAR and DFAST, BHCs and other financial institutions can make compliance testing faster and accurate. They can also reduce risks of spreadsheet errors and omissions affecting other aspects of their business. For more information about Incisive solutions, please visit or call +1 (408)