January 5, 2009

Case Study: Hypo Real Estate

Enables Credit Risk Professionals
With Business Rules
by Mike Gualtieri
for Application Development & Program Management Professionals

Making Leaders Successful Every Day

For Application Development & Program Management Professionals

January 5, 2009
Case Study: Hypo Real Estate Enables Credit Risk
Professionals With Business Rules
Achieve Greater Agility, Transparency, And Compliance In An Uncertain
Regulatory Environment
by Mike Gualtieri
with John R. Rymer, Charles Brett, Mike Gilpin, and Wallis Yu

Exec ut i v e S u mmary
Uncertainty in lending regulatory requirements is putting pressure on credit risk modelers to become
more responsive. Munich-based Hypo Real Estate Group (HRE), an international banking specialist
for commercial real estate markets and the public sector, implemented a new credit risk management
approach. The result: Application development professionals are no longer a bottleneck, and credit
risk modelers can respond more quickly to changing regulatory requirements. HRE’s experience
suggests that business rules platforms will help many financial services firms be more responsive and
more compliant in today’s uncertain regulatory environment. Application development professionals
can learn from HRE’s best practices, which are to: 1) provide risk modelers with a rules-authoring
environment and 2) create a formal, collaborative rules life cycle.

tab l e o f Co nte nts NOT E S & RE S OU RCE S

2 The Best And The Worst Of Times For Credit Forrester interviewed David Kang, head of Hypo
Risk Modelers Real Estate’s credit risk analytics team.
6 Best Practice: HRE Provided Quants With A
Rules Authoring Environment Related Research Documents
7 Best Practice: HRE Created A Formal, “The Truth About Business Rules Algorithms”
Collaborative Rules Life Cycle July 24, 2008

7 Best Practice Results: HRE Achieves Greater “The Forrester Wave™: Business Rules Platforms,
Agility In Credit Rating Q2 2008”
April 8, 2008
WHAT IT MEANS
9 The Benefits Of Business Rules Are Not
Limited To Credit Risk Modeling

© 2009, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available
resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, RoleView, TechRadar,
and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. To
purchase reprints of this document, please email clientsupport@forrester.com. For additional information, go to www.forrester.com.
2 Risk Professionals With Business Rules
For Application Development & Program Management Professionals

The Best and the Worst of Times for Credit Risk Modelers
Don’t blame the credit risk modelers (sometimes called quants) for the current financial-industry
meltdown. The credit risk models that they create are only effective if dealmakers use them, and
many did not. It is the best of times and the worst of times for quants who are responsible for
creating the methods and models for rating the risk of huge commercial real estate and public
infrastructure financing deals:

· The good news for quants: It is the best of times for quants because having excellent credit risk
models is more important than ever in this challenging economic environment.

· The bad news for quants: It is the worst of times for quants because the pressure is on to be
more responsive to increasing regulatory requirements, corporate risk policies, and new ways of
rating credit risk.

HRE Is A Microcosm Of The Problem And Shows The Way To A Potential Solution
One firm subject to these pressures is Hypo Real Estate (HRE) of Munich, Germany.1 HRE finances
international, commercial real estate projects and, because of its October 2007 acquisition of
Dublin-based DEPFA Bank (DEPFA), now also finances the public sector and infrastructure
projects such as roads and bridges throughout the world.2

David Kang heads HRE’s credit risk analytics team and has a staff of five credit risk modelers who
are responsible for creating and maintaining about 30 models used to rate incoming and existing
deals. These are not the devilishly complex risk models of the investment credit risk modelers whom
Warren Buffet described as “geeks bearing formulas.”3 Rather, HRE dealmakers use Mr. Kang’s
team’s models to determine risk ratings for individual deals. The more complex models can have as
many as 40 input factors, while simpler models may have only 10 input factors. Each model’s output
is always in the form of a risk rating such as A+ or AA. A deal’s risk rating has a huge impact on
whether or not HRE closes the deal and on determining the terms of the deal.

HRE Had Two Credit Risk Approaches — A Third Was Waiting In The Wings
Acquiring DEPFA gave HRE the opportunity to create a single, standard approach to credit
risk modeling for both lines of business.4 Before proceeding, HRE was able to compare the two
companies’ systems:

· HRE deployed models as Java Web applications. HRE’s previous approach to credit risk
modeling was for quants to create and test each model using Excel and then work with
application developers to build a Web-based Java application to implement the model. This
traditional approach is widespread at other banks. Although this approach worked, it required
quants to create methodologies and models in Excel and then communicate those requirements
to application developers who sometimes had difficulty understanding models because of their

January 5, 2009 © 2009, Forrester Research, Inc. Reproduction Prohibited

 Risk Professionals With Business Rules 3
For Application Development & Program Management Professionals

complexity. Producing new models or making changes to existing models could take as long
as six months: Developers had to code the models in Java, and quants had to retest them once
developers had implemented them in the Java application.

· DEPFA deployed models in Excel. Mr. Kang’s due diligence of DEPFA’s approach to credit risk
models revealed that DEPFA used Excel spreadsheets not only to develop the models but also to
deploy them. According to Mr. Kang, it is not uncommon for quants to use Excel to create and
test models, but using Excel for deployment is unacceptable because “German regulators would
not accept Excel as a proper IT environment.”

The previous HRE approach lacked agility but would meet regulatory requirements — which
DEPFA’s more agile approach would not. What HRE needed was the best of each approach: the
flexibility for credit risk modelers to create and test their own models plus the robustness of a solid
IT environment (see Figure 1).

A possible solution arose in a technology DEPFA had been considering prior to the acquisition:
DEPFA had planned to replace Excel with Visual Rules, a business rules platform offered by
Innovations Software Technology.5 Mr. Kang’s initial examination of the capabilities of Visual Rules
led him to an unexpected revelation: If it worked, the business rules approach would not only satisfy
the German regulators’ requirements; it would also give his group of risk modelers the ability to
create, maintain, and test the credit risk models directly using the Visual Rules authoring tool.

IT was initially skeptical when Mr. Kang approached them with his findings; IT voiced concerns
about risk modelers’ ability to “program” the models in the Visual Rules environment and about
who would control deployment to production. But after seeing a demo and working out a process
whereby IT controls deployment to production, IT decided to go along with the new business
rules approach because it enabled the credit risk modelers while also keeping controls in place for
deployment.

HRE Replaced Excel And Java With Business Rules

In April 2008, HRE made the decision to move forward with Visual Rules and started a project to
implement the existing models of DEPFA in business rules and to run them in parallel against the
existing Excel spreadsheets. According to Mr. Kang, the new platform works well: “I think a lot
of banks don’t know that something like this exists or don’t trust it. In reality, using this business
rules platform is very flexible and easy.” The new business rules approach satisfied regulators, risk
modelers, dealmakers, and IT:

· Regulators are satisfied because the models are auditable. When HRE acquired DEPFA, it was
clear that the German regulators would not accept the use of Excel as a credit risk management
tool. The new approach has a well-defined, auditable process for creating models and deploying
them on IT-supported infrastructure. The German regulators did not consider emailing
multiple versions of Excel spreadsheets around to be a “proper IT environment.”

© 2009, Forrester Research, Inc. Reproduction Prohibited January 5, 2009

4 Risk Professionals With Business Rules
For Application Development & Program Management Professionals

Figure 1 Each Approach Has Advantages And Disadvantages

Approach Advantages Disadvantages

Excel spreadsheets Credit risk modelers can create,
change, and test models directly in
Excel.
• Multiple versions of spreadsheets can
result in dealmakers using an outdated
credit model.
• Use of the model is not auditable
since dealmakers use it locally.

Custom-developed • Having a centralized application
Java Web application means that all dealmakers are using
the current version.
• The use of the models by the
dealmakers is auditable.
• Risk modelers still have to use another
tool, such as Excel, to develop and test
changes to models.
• Changes to the models have to be
translated into requirements for
application developers, resulting in a
longer implementation time.

Business rules platform • Credit risk modelers can create, Credit risk modelers will have to learn
change, and test models directly how to use a new tool.
using a rules authoring tool.
• Having a centralized application
means that all dealmakers are using
the current version.
• It provides auditing capabilities.
• The rules application can be deployed
in a managed IT environment.

47738 Source: Forrester Research, Inc.

· Risk modelers are happy because they have a better tool. Mr. Kang’s credit risk modelers have
a powerful new tool that allows them to create, change, and test models that will be deployed
directly when ready; they no longer need to wait for developers to translate the requirements
of the Excel model into a Java application (see Figure 2 and see Figure 3). This saves time and
avoids requirements getting lost in translation.

· Dealmakers are satisfied because they have access to the correct credit models. The former
DEPFA credit risk analysts now can access the credit models confidently through the Web
interface; they no longer have to wonder whether or not they are using the correct spreadsheet.
They also know that their use of the model is audited, which provides proof of what input
parameters they used to determine a risk rating for each specific deal.

· IT is happy because it no longer has to be the bottleneck. IT always has enough to do and is
always dealing with the “do more with less” mantra coming from the business. Implementing
the business rules solution freed up Java developers to work on other projects: Now that the
quants are using the new tool, IT no longer needs to write code for the models, yet IT’s control
over the life cycle keeps the production application in IT’s purview.

January 5, 2009 © 2009, Forrester Research, Inc. Reproduction Prohibited

 Risk Professionals With Business Rules 5
For Application Development & Program Management Professionals

· David Kang is happy because his team can now change direction quickly when necessary.
When the regulators come knocking to discuss credit risk models, Mr. Kang’s group must
respond. The business rules solution gives Mr. Kang and his team of quants the ability to
respond more quickly to changing regulatory requirements and company policies.

Figure 2 Credit Risk Modelers Use The Authoring Tool To Create, Maintain, And Test Models

47738 Source: Forrester Research, Inc.

© 2009, Forrester Research, Inc. Reproduction Prohibited January 5, 2009

6 Risk Professionals With Business Rules
For Application Development & Program Management Professionals

Figure 3 Dealmakers Use The Credit Risk Rating Web Application To Get A Risk Rating

Input: quantitative variables

Output: Credit rating

47738 Source: Forrester Research, Inc.

Best Practice: HRE provided quants with a rules authoring environment

An important benefit of implementing a business rules platform is that the risk modelers can use
the business rule authoring tools to develop, change, and test the credit risk models. As Mr. Kang
explains, “We are the model owners, and we know what models to implement.”

Business rules platforms provide authoring flexibility by offering one or more rule authoring
metaphors, which might include if-then-else statements, flowcharts, decision trees, and decision
tables.6 These tools enable business users such as HRE’s quants the ability to develop the rules
themselves using Visual Rules. Visual Rules provided HRE with:

· A graphical authoring tool in which creating a model is akin to designing a flowchart.

Quants are extremely analytical and have a deep knowledge of statistics and financial
mathematics. That kind of knowledge often translates well to the ability to express logic. HRE’s
risk modelers were able to recreate some of their models in the new tool within two weeks.

January 5, 2009 © 2009, Forrester Research, Inc. Reproduction Prohibited

 Risk Professionals With Business Rules 7
For Application Development & Program Management Professionals

· The ability to deploy models to HRE Web servers. After the models that the quants create
have been tested, IT can deploy them to a production Web application. HRE IT worked with
Innovations Software Technologies to automatically generate a Web-based user interface for the
models. IT deploys finished applications on HRE servers, where credit risk analysts can access
them and then use them to determine risk ratings for potential deals.

Best practice: HRE created a formal, collaborative Rules Life cycle

Using or not using the right credit risk model can make or break a deal. It is essential that credit
risk analysts use the most up-to-date credit models. Understanding this, HRE originally built its
Java Web-based application to have a central and consistent way of developing, testing, deploying,
and using the models. Business rules implementations require a life-cycle management process that
balances the quants’ authoring freedom with the release management processes needed to protect
the application environment.

Deploying bug-ridden rules is more likely in scenarios involving business users who are not familiar
with the careful processes that application developers put in place to manage changes and prevent
disastrous deployments. To prevent deploying buggy rules while maintaining modelers’ agility, HRE
created a rule life-cycle process that:

· Does not encumber the risk modelers. Using the Visual Rules authoring tool, risk modelers
have complete independence to create new models, experiment, and test. They do this with
complete knowledge that when they finish their model, they will not then have to explain
the complexities of the model to a developer before it is implemented and makes its way into
production.

· Enables IT to retain control of deployment. HRE developed a clearly defined yet simple
process in which the credit risk department hands off new models to IT for deployment. IT likes
that Visual Rules generates Java code and that IT deploys the rules application as a JAR file just
like any other Java application.7

Best Practice Results: HRE achieves Greater Agility IN Credit Rating

HRE’s new business rules platform provides much greater agility by cutting out the extra
development time needed when involving IT. Mr. Kang explained: “With the business rules
environment, we don’t have to involve IT at all. We just do it ourselves. If IT were to do it,
developers would keep coming back to us because they don’t have the background in modeling.”

Credit Risk Modelers Achieve Greater Agility, Transparency, And Compliance

Although HRE initially set out to find the best-of-breed credit risk application, it obtained much
more: Credit risk modelers can now respond faster to changing regulatory requirements; IT is no
longer the bottleneck. HRE achieved a credit risk application that:

© 2009, Forrester Research, Inc. Reproduction Prohibited January 5, 2009

8 Risk Professionals With Business Rules
For Application Development & Program Management Professionals

· Increases agility in developing, changing, testing, and deploying credit models. Enabling risk
modelers to develop and change models directly eliminates time-consuming steps such as risk
modelers translating the model to requirements for an application developer as well as the many
iterations of development and testing before IT can correctly implement the model.

· Maintains consistent use of the most current models throughout the organization. Excel
is a nightmare when it comes to ensuring consistent use of models. HRE’s Web-based Java
application provides a centralized way of accessing the most current models, and it was
important that HRE’s business rules implementation maintain that consistency. HRE’s
implementation of Visual Rules succeeds in this goal by using the built user-interface generator
to automatically create a Web-based Java application from the model’s rules.

· Improves model transparency for analysis and regulatory compliance. When risk modelers
explain new models or methods to application developers, some requirements are bound to get
lost in translation. This method also makes it more difficult for regulators to know what is going
on once IT implements the models in Java or another programming language. Because the
business rules platform enables quants to develop rules directly, regulators can be more certain
that the quant-created models are the ones running in the business.

Application Developers’ Stock Goes Up Because They Are No Longer The Bottleneck
The implementation of the business rules platform — and especially the tool that enables risk
modelers to “program” their own models — took application developers out of the credit risk
modeling business. Credit risk modelers can now change their own rules, avoiding the time-
consuming step of translating the requirements to application developers who must then implement
the model in Java.

Although IT no longer codes the models, it still plays a crucial role in ensuring that:

· The models are deployed on the Web infrastructure. Giving IT control of the production
environment helps ensure that the rules life-cycle process is followed — which prevents
developers, whether from the business or IT, from deploying models that have not been
properly tested.

· The quants have the support they need when using the new tool. IT also has the role of
supporting the tool and the rules runtime environment. This can involve installing or making
available software updates, ensuring that server versions are in sync with the tools, and fielding
user questions or routing them to the vendor.

January 5, 2009 © 2009, Forrester Research, Inc. Reproduction Prohibited

 Risk Professionals With Business Rules 9
For Application Development & Program Management Professionals

W H A T IT M E A N S

The benefits of business rules are not limited to credit risk modeling
Agility, transparency, and compliance are important for more than just credit risk modeling:
Many other areas of organizations must also deal with changing regulatory requirements,
changing company policies, and changing decision rules. Any area that requires constant
change and business knowledge can benefit from using business rules to enable business users.
To understand more about how best to use business rules, read Forrester’s “Best Practices In
Implementing Business Rules” for a comprehensive set of best practices.8

Endnotes
1
Hypo Real Estate Group is one of many German banks that have been hurt by the financial crisis. On
October 31, 2008, Hypo secured 15 billion euros from the German government rescue plan. Source: Ludwig
Burger, “Hypo Real taps $19.6 billion in government guarantees,” Reuters, October 31, 2008 (http://www.
reuters.com/article/innovationNews/idUSTRE49U3D420081031).
2
DEPFA Bank plc was created in June 2002 by the split of the German-based DEPFA Mortgage Bank to act
as a pure public finance bank. For more about the history of the German DEPFA bank, see http://www.
depfa.com/about/934.html.
3
Warren Buffet, chairman of Berkshire Hathaway and one of the world’s richest persons, is well known for
his investment wisdom. Source: Richard Dooling, “The Rise of the Machines,” The New York Times, October
11, 2008 (http://www.nytimes.com/2008/10/12/opinion/12dooling.html?n=Top/Reference/Times%20
Topics/Subjects/D/Derivatives).
4
HRE focused its initial efforts on using Visual Rules to replace the use of Excel at DEPFA. HRE plans to roll
out the Visual Rules approach to its original real estate financing group once it has completed the DEPFA
conversion.
5
Visual Rules is a business rules platform offered by Innovations Software Technology. Innovations Software
Technology was recently acquired by Bosch. For an evaluation of Visual Rules 3.5.1 and 12 other business
rules platforms, please see the April 8, 2008, “The Forrester Wave™: Business Rules Platforms, Q2 2008”
report.
6
Forrester found that vendors offer a number of different rule authoring metaphors, the most popular
being textual rules, decision tables, and flowcharts. See the July 24, 2008, “The Truth About Business Rules
Algorithms” report.
7
A Java Archive Resource (JAR) file is a way of packaging a set of Java code into a single file so that it can be
easily deployed to a server. Other common deployment files for Java are Web Archive Resource (WAR) files
and Enterprise Archive Resource (EAR) files.

© 2009, Forrester Research, Inc. Reproduction Prohibited January 5, 2009

10 Risk Professionals With Business Rules
For Application Development & Program Management Professionals

8
A recent Forrester report gives advice on how to achieve success in implementing business rules that will
empower your business users and in avoiding insidious pitfalls. It recommends that organizations follow
these four best practices: 1) assemble a team that knows business rules implementation; 2) establish a
methodology to find your rules; 3) design with business users in mind; and 4) include business users in
your rules life-cycle process. See the October 3, 2008, “Best Practices In Implementing Business Rules”
report.

January 5, 2009 © 2009, Forrester Research, Inc. Reproduction Prohibited

 Making Leaders Successful Every Day

Headquarters Research and Sales Offices

Forrester Research, Inc. Australia Israel
400 Technology Square Brazil Japan
Cambridge, MA 02139 USA Canada Korea
Tel: +1 617.613.6000 Denmark The Netherlands
Fax: +1 617.613.5000 France Switzerland
Email: forrester@forrester.com Germany United Kingdom
Nasdaq symbol: FORR Hong Kong United States
www.forrester.com India

For a complete list of worldwide locations,

visit www.forrester.com/about.

For information on hard-copy or electronic reprints, please contact Client Support

at +1 866.367.7378, +1 617.613.5730, or clientsupport@forrester.com.
We offer quantity discounts and special pricing for academic and nonprofit institutions.

Forrester Research, Inc. (Nasdaq: FORR)

is an independent research company
that provides pragmatic and forward-
thinking advice to global leaders in
business and technology. Forrester
works with professionals in 19 key roles
at major companies providing
proprietary research, consumer insight,
consulting, events, and peer-to-peer
executive programs. For more than 25
years, Forrester has been making IT,
marketing, and technology industry
leaders successful every day. For more
information, visit www.forrester.com.

47738