We learned that the dispersion was largely due to varying risk parameters used by the institutions, which was permissible in the QIS4 exercise, but also due to portfolio differences. That is, banks have different approaches to risk-management processes, and their models and databases reflect those differences.
We also learned that some of the data submitted by individual institutions was not complete; in some cases banks did not have estimates of loss in stress periods--or used estimates that we thought were not very sophisticated--which caused minimum regulatory capital to be underestimated. Based on the results of QIS4, the Federal Reserve recognizes that all institutions have additional work to do.