Oper
atio
nal R
isk
Agenda
• Operational risk: definition • Peculiarities of operational risk • Measuring operational risk • From OR measurement to OR management • The Basel Committee capital requirements
3
OR: a definition problem
Some major banks’ definitions • “The risk that deficiencies in info systems or internal controls will
result in unexpected loss. The risks associated with human error, systems failure and inadequate procedures and controls”
• “The potential of any activity to damage the organization, including physical, financial and legal risks”
• “Risk that deficiencies in information systems or internal controls will result in financial loss, failure to meet regulatory requirements or an adverse impact on the bank’s reputation”
• “The risk of loss through inadequate systems, controls and procedures, human error or management failure”
• All risks which are not banking (ie it excludes credit, market, and trading risks, and those arising from business decisions etc.)
Oper
atio
nal R
isk
4
OR: definition
Basel (2004): “The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events”
OR Factors
• Human: errors, fraud, lack of info, incompetence, etc. • Information systems: interruptions, failures, errors, etc. • Procedures: inadequate, obsolete, absent • External: political, natural, etc. It does not generally include legal and reputational risks
Oper
atio
nal R
isk
5
OR: some distinctive features
Credit and Market Risks
• Measurable • Generally well understood and identifiable • Generally taken “consciously” • Can be “priced” • Coherent with the “risk/return” framework • Relatively easy to allocate
Oper
atio
nal R
isk
6
OR: some distinctive features
Operational Risk
• Difficult to quantify • Generally poorly understood • Generally taken “inevitably” • Cannot be “priced” ! no liquid market • Not always coherent with the “risk/return”
framework
Oper
atio
nal R
isk
7
Measuring OR
Problems
• Some events have non-measurable consequences (e.g. loss of reputation)
• Lack of historical data • Some events are very rare (natural disasters) • History is often a poor indicator of future potential
events
Oper
atio
nal R
isk
8
Measuring OR
Two types of events
• LFHI: low frequency (rare events - low probability), high impact (severity) events (large negative consequences-losses)
• HFLI: high frequency (high probability), low impact (severity) events (low losses)
Oper
atio
nal R
isk
9
" Due to mismanagement in the day to day business activity " Can be reduced by improving efficiency/effectiveness of procedures " Expected losses can be estimated through an adequate data base
Severity
HFLI Events
" Low frequency often does not allow to understand what are the real causes behind them
" The lack of internal historical data requires to use external data sources
LFHI Events
Freq
uenc
y
Oper
atio
nal R
isk
Measuring OR
10
Measuring OR
Typical process structure 1. Identification of potential risk sources (mapping) 2. Estimate of event probability ! PE 3. Estimate of severity (amount of potential loss) !
LGE 4. Estimate of expected loss ! EL = PE x LGE 5. Estimate of unexpected loss (UL) and VaR/EC
Oper
atio
nal R
isk
11
The first step is to build up a list of potential events Example: Internal Fraud • Theft • Disruption of goods • Falsification • Identity appropriation • Tax evasion • Corruption • Insider trading • Balance sheet alteration • Functional power abuse • Collusion
Identification of risk factors Op
erat
iona
l Risk
12
Risk mapping and loss event database
Business line Internal Fraud
External Fraud
Security Customers and Products
Problems to physical properties
Systems failure
Process Mgmt
Corporate Finance
Intermediation
Retail Banking
Commercial Banking
Payment system
Brokerage retail
Oper
atio
nal R
isk
13
Exposure Indicator Op
erat
iona
l Risk
• An exposure indicator can be used to estimate exposure, different for different business units
• It works as a scale variable, indicating how severe an operational loss could be, if it were to happen in a given business line and/or because of a certain type of risk factor.
• Examples: – total revenues – gross operating income – assets under management
14
Probability estimation
" For every risk factor and for all the business units we must estimate the probability associated to each risky event (PE)
" To estimate PE for each individual business unit or line and for every risk factor a qualitative evaluation and a rating can be used
" Similarly to credit risk, an OR rating can be used to estimate probability
" For HFLI events banks generally rely on internal data
" For LFHI events internal historical data are often not enough ! external data (data pooling)
Oper
atio
nal R
isk
15
Risk factor Qualitative rank
Rating (1= low risk;
10 = high risk)
Probability range
1. Human resources
- fraud Intermediate/Low 3 0,3%-0,5%
- incompetence Intermediate 5 1,0%-2,0%
- Rule violation High 9 7,0%-10,0%
2. Technology
- systems Intermediate 4 0,5%-1,0%
- programming mistakes Intermediate/High 8 5,0%-7,0%
- telecommunication Low 2 0,1%-0,3%
3. Process
- model risk High 10 >10,0%
- transaction risk Intermediate 6 2,0%-3,0%
- documentation risk Intermediate/Low 3 0,3%-0,5%
4. External factors
- political risk Low 1 0,0%-0,1%
- regulatory/fiscal risk Intermediate/High 8 5,0%-7,0%
- natural events Low 2 0,1%-0,3%
Example Op
erat
iona
l Risk
16
Internal Fraud External
Fraud Employment Practices and
Workplace Safety Clients,
Products and Business Services
Damage to Physical Assets
Business Disruption
and System Failure
Execution, Delivery and
Process Management
Total
Corporate Finance 4 (0,01%) 3
(0,01%) 16 (0,06%) 15
(0,05%) 8 (0,03%) 1
(0,00%) 33 (0,12%) 80
(0,29%)
Trading and Sales 16 (0,06%) 6
(0,02%) 37 (0,14%) 112
(0,41%) 10 (0,04%) 39
(0,14%) 1.114 (4,07%) 1.334
(4,87%)
Retail Banking 593 (2,17%) 7.798
(28,49%) 579 (2,12%) 1.273
(4,65%) 837 (3,06%) 570
(2,08%) 6.807 (24,87%) 18.457
(67,43%)
Commercial Banking 93 (0,34%) 1.180
(4,31%) 55 (0,20%) 66
(0,24%) 285 (1,04%) 474
(1,73%) 1.463 (5,35%) 3.616
(13,21%)
Payment and Settlement 22
(0,08%) 961 (3,51%) 9
(0,03%) 57 (0,21%) 40
(0,15%) 64 (0,23%) 752
(2,75%) 1.905 (6,96%)
Agency and Custody Services 6
(0,02%) 7 (0,03%) 12
(0,04%) 69 (0,25%) 17
(0,06%) 11 (0,04%) 356
(1,30% 478 (1,75%)
Asset Management 4 (0,01%) 4
(0,01%) 21 (0,08%) 35
(0,13%) _ 6 (0,02%) 360
(1,32%) 430 (1,57%)
Retail Brokerage 7 (0,03%) 2
(0,01%) 12 (0,04%) 122
(0,45%) 28 (0,10%) 291
(1,06%) 609 (2,22%) 1.071
(3,91%)
Total 745 (2,72%) 9.961
(36,39%) 741 (2,71%) 1.749
(6,39%) 1.225 (4,48%) 1.456
(5,32%) 11.494 (41,99%) 27.371
(100,00%)
Sample: 30 international banks Number of events for each BL and type of
event Op
erat
iona
l Risk
17
" To estimate severity (Loss Given Event – LGE) we need to evaluate the potential impact of the risk factor over the business unit
" On a qualitative basis, usually banks apply ranks like the following one
Severity estimation
Severity Value (euro)
Description
High Loss > 10 m Event that produces effects extremely relevant over the balance sheet, liquidity or on a regulatory basis
Intermediate-High
10 m > Loss > 1 m Event that produces effects relevant over the balance sheet, liquidity.
Intermediate-Low
1 m > Loss > 100,000 Event that produces modest effects over the balance sheet and the liquidity
Low Loss < 100,000 Event that produces small effects over the balance sheet
Oper
atio
nal R
isk
18
Internal Fraud External
Fraud Employment Practices and
Workplace Safety
Clients, Products and
Business Services
Damage to
Physical Assets
Business Disruption
and System Failure
Execution, Delivery and
Process Management
Total
Corporate Finance 3.293 (0,13%) 25.231
(0,97%) 6.114 (0,23%) 131.012
(5,01%) 18 (0,00%) _ 28.432
(1,09%) 194.100 (7,43%)
Trading and Sales 68.819 (2,63%) 826
(0,03%) 7.845 (0,30%) 89.054
(3,41%) 138 (0,01%) 6.237
(0,24%) 326.563 (12,50%) 499.481
(19,11%)
Retail Banking 115.578 (4,42%) 210.026
(8,04%) 54.600 (2,09%) 387.447
(14,83%) 61.176 (2,34%) 2.110
(0,08%) 198.820 (7,61%) 1.029.757
(39,41%)
Commercial Banking 78.869 (3,02%) 287.855
(11,02%) 3.662 (0,14%) 76.217
(2,92%) 14.033 (0,54%) 1.424
(0,05%) 136.659 (5,23%) 598.717
(22,91%)
Payment and Settlement 750 (0,03%) 5.447
(0,21%) 719 (0,03%) 1.144
(0,04%) 2.061 (0,08%) 2.705
(0,10%) 112.659 (4,30%) 125.295
(4,79%)
Agency and Custody Services 2.265
(0,09%) 281 (0,01%) 374
(0,01%) 7.635 (0,29%) 860
(0,03%) 1.718 (0,07%) 43.310
(1,66%) 56.443 (2,16%)
Asset Management 8.566 (0,33%) 603
(0,02%) 1.075 (0,04%) 8.978
(0,34%) 664 (0,03%) 34.841
(1,33%) 54.728 (2,09%)
Retail Brokerage 445 (0,02%) 596
(0,02%) 1.845 (0,07%) 17.485
(0,67%) 575 (0,02%) 6.471
(0,25%) 27.127 (1,04%) 54.545
(2,09%) Total 278.586
(10,66%) 530.866 (20,32%) 76.235
(2,92%) 718.971 (27,51%) 78.860
(3,02%) 21.329 (0,82%) 908.219
(34,76%) 2.613.066 (100,00%)
Gross losses by business line and
event type Op
erat
iona
l Risk
19
Info sources Op
erat
iona
l Risk
Table 5 – Information sources for the measurement of OR Probability of event (PE) Loss given event (LGE)
! Internal audit reports ! Internal historical events data ! Management reports ! Experts’ opinions (Delphi techniques1) ! Vendors’ estimates ! Budgets ! Business plans
! Management interviews ! Internal historical loss data ! Historical loss data from other banks or
consortium data series ! Industry benchmark ! External estimates (consultants,
dataproviders, vendors, etc.) Source: adapted from Crouhy, Galai, Mark (2000)
1 Delphi are iterative techniques aimed at developing consensus among different people which can be used to obtain a group estimate of the probability of future events.
20
The Basel Committee Survey
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
70,00%C
orpo
rate
Fina
nce
Trad
ing
& S
ales
Ret
ail B
anki
ng
Com
me
rcia
l
Ban
king
Paym
ent
&
Set
tlem
ent
Age
ncy
&
Cus
tody
Ass
et
Man
agem
ent
Ret
ail B
roke
rage
Business line
Ripartizione % del numero d i eventi d i perd ita e de ll'importo medio de lle perd ite per business line (30 banche - 1998-2000)
Number of loss events Gross Loss Amount
Oper
atio
nal R
isk
21
0,00%
5,00%
10,00%
15,00%
20,00%
25,00%
30,00%
35,00%
40,00%
45,00%
InternalFraud
ExternalFraud
Employmentpractices &w orkplace
safety
Clients,products &
bus.services
Damage tophysicalassets
Bus.disruption &system fail.
Execution,delivery &process
mgmt
Tipo di evento rischioso
Distribuzione % numero eventi di perdita e perdite medie per tipo di evento - Dati relativi a 30 banche (1998-2000)
Number of loss events Gross Loss Amount
The Basel Committee Survey Op
erat
iona
l Risk
22
Expected Loss
" We need to define the EL for each business line and risk category: " Event probability (PE) " Loss given event (LGE)
" Alternatively
LGEPEEL ⋅=
Oper
atio
nal R
isk
LGERPEEIEL ⋅⋅=
23
Let us imagine 2 BU with the same EL but with different volatility
Business Unit A B
PE 0.2% 10%
LGE – ml euro 100 2
EL – ml euro 0.2 0.2
LFHI HFLI
Expected Loss Op
erat
iona
l Risk
24
" The unexpected loss is a measure of the average volatility of the operational losses.
" The UL can be estimated: I. In aggregate terms for all the bank using the
internal time series, as standard deviation of the total losses generated by OR
II. For each BU using the internal time series, as standard deviation of the BU losses generated by OR
III. For each risk factor using internal or external data
IV. Separately for each BU or each risk factor using at the same time internal and external data
Unexpected Loss Op
erat
iona
l Risk
25
" Without historical data, a way to estimate the unexpected loss is to use the binomial distribution of losses
" In this case we have only two events
Event Loss Probability
The event happens LGE PE
The event does not happen
0 1-PE
Unexpected Loss Op
erat
iona
l Risk
26
" We can now estimate average and standard deviation
" If the average probability of the event is 1% and a LGE of 50.000 euro, the unexpected loss is computed as follows
( ) LGEPEPELGEPEEL ⋅=⋅−+⋅== 01µ
( )PEPELGEUL −⋅⋅== 1σ
975,499.001.0000.50 =⋅⋅=UL
The unexpected loss Op
erat
iona
l Risk
27
UL as a function of PE Op
erat
iona
l Risk
Loss volatility as a function of the probability of the event (PE) Unexpected loss corresponding to an expected loss of 500,000 euro
0
5.000
10.000
15.000
20.000
25.000
30.000
35.000
40.000
45.000
50.000
0,01%
0,40%
0,90%
1,40%
1,90%
2,40%
2,90%
3,40%
3,90%
4,40%
4,90%
5,40%
5,90%
6,40%
6,90%
7,40%
7,90%
8,40%
8,90%
9,40%
9,90%
Probability of Event (PE)
UL
- Eur
o 00
0s
HFLI events
HFLI events
Given EL, UL is negatively related to PE
28
" If LGE is not deterministic
If sigma LGE = 20%, PE = 1%, LGE = 50,000 UL = 11,169 euro > 4,975 euro with constant LGE
The unexpected loss Op
erat
iona
l Risk
( )( )2 2 2 21 (1 )LGE LGEPE PE LGE PE PE PEσ σ σ= ⋅ − + ⋅ + ⋅ − ⋅
( )( )2 21 LGEPE PE LGE PEσ σ= ⋅ − + ⋅
29
CAR estimation
" How to estimate VAR? " Starting from a functional form of RO
losses, the same for all the BU of the bank " Defining a capital multiplier to apply to the
unexpected loss " Estimating the economic capital absorbed
by each bank unit, multiplying the UL to the capital multiplier
%%, CLCLOR kULCaR ⋅=
• CaRRO,CL is the VaR under a confidence level
• kCL% is the capital multiplier.
Oper
atio
nal R
isk
30
CAR estimation Op
erat
iona
l Risk
Unit A Unit B Input
EI PE LGER Sigma LGER
1,000,000 1,000,000 0.20% 5.00% 5.00% 0.20%
10.00% 0.50% Output EL 100 100 UL with constant LGER 2,234 436 UL with stochastic LGER 4,999 1,200 CaR with confidence level: 95.0% 8,323 2,074
97.5% 9,898 2,452 99.0% 11,729 2,892 99.5% 12,977 3,191 99.9% 15,548 3,808
Example for 2 Business Units
31
CAR estimation
" OR capital at risk can also be estimated using simulation approaches
" The relative lack of historical data makes it advisable to use Monte Carlo simulations, which typically require less data than historical simulations
" Once a functional form of the OR loss distribution has been estimated or assumed, it is possible to simulate future losses associated with different scenarios and to build a simulated distribution on which the appropriate percentile can be read
Oper
atio
nal R
isk
32
OR Management
Objectives of an OR management system • Reduce the amount of OR • Eliminate the sources of OR • Allocate OR based on each BU contribution to its
generation • Give each BU an incentive to reduce it (example
through RAPM) • Estimate the amount of capital needed to support
it
Oper
atio
nal R
isk
33
OR Management
Three alternative otions " Keep: OR is kept by the bank ! typically HFLI
events " Insure: OR is �hedged� through insurance policies
! LFHI events (typically external events, where no moral hazard problem exists)
" Hedge: OR is �hedged� through investments in human resources, procedures, control systems, etc. ! HFHI events
" LFLI events are not relevant
Oper
atio
nal R
isk
34
" Active OR management can involve risk transfer or hedging tools " Insurance solutions
" e.g. rogue trading insurance " Financial solutions " Operational Risk Derivative " Catastrophe bond (CAT bonds) " OR swaps
Oper
atio
nal R
isk
OR Management
35
Basic approach
Standardised approach
Advanced measurement approaches
Simplest one. Based on a simplified proxy of the bank�s risk.
Evolution of the basic approach. Higher sophistication comes from the fact that a different capital requirement is imposed to different business units.
Banks use their own internal models subject to specific conditions imposed by national supervisory authorities.
Three alternative approaches — Approach— — Characteristics—
+ Sophistication
+ Implementation costs
+ Expected capital savings
Basel OR capital requirement
36
Basic Approach
OR Capital Requirement = α* Gross Operating Income
Very simple. Used by small, less sophisticated banks
α
GOI
The value is 15%.
NII (Net Interest Income) + Net Fee Income + Trading Gains/Losses
Basel OR capital requirement
37
• Each Business Line has a different β and gets its OR capital requirement
• Most large banks chose this approach
• In order to adopt this approach banks have to satisfy certain criteria related to OR mgmt
Business Unit Business Line
Corporate Finance
Trading & Sales
Retail Banking
Commercial Banking
Payment and Settlement
Agency Services and custody
Asset Management
Retail Brokerage
Investment Banking
Banking
Others
Standardized Approach OR Capital Requirement = ∑i βi * GOIi
Basel OR capital requirement
40
The different Beta values by Business line
BUSINESS LINE Factor Beta Corporate Finance 18% Trading & Sales 18% Retail Banking 12% Commercial Banking 15% Payment & Settlement 18% Agency Services and custody 15% Asset Management 12% Retail Brokerage 12%
Basel OR capital requirement
41
Internal Measurement Approach
Loss Distribution Approach
Scorecard Approach
Once an OR CR has been set (based on one of the two approaches), its evolution depends on a qualitative eval. of the prospective riskiness of each BL, not on historical data
OR Capital Requirement is estimated based on the loss prob. distribution of each bus. line, directly estimating UL
OR Capital Requirement is estimated assuming a stable relationship between expected loss (EL) and unexpected loss (UL), proxied by a γ coefficient defined by supervisors:
OR Capital Requirement = ∑i γi * EIi * PEi *LGEi = ∑i γi * ELi
Basel OR capital requirement
42
Summary
• OR is difficult to define: one needs to identify the causal factors
• OR is inevitable, complex to quantify, not coherent with a risk-return framework
• The objective of an OR management system should be to minimize it
• OR control depends on the amount and quality of resources (human, IT, etc.)
43
Questions & Exercises 1. Consider the following statements: operational risk is different from “financial risks” (like market or credit risk) because… I. …it cannot be avoided; II. …it affects insurance companies, not banks; III. …an increase in risk does not necessarily bring about higher expected returns; IV. …it cannot be covered through capital. Which one(s) would you agree with? A. Only IV; B. Only I; C. I and III; D. I and II.
44
Questions & Exercises
2. For each of the following loss events, indicate the risk factor(s) (people, systems, processes or external events) to which it can be ascribed: A. the tax rate on the bank’s bestselling certificates of deposit is raised from 10% to 30%, causing a drop in demand; B. some customer files are missing/incomplete and the backup data cannot be reconciled with the original ones; C. an expense item was improperly treated as tax-deductible, leading to undemating taxable profits and to evading taxes, so that the bank now has to pay a fine; D. the bank’s chief treasury officer illegally had some FX profits moved to his personal account in Monte Carlo.
45
Questions & Exercises
3. What is an exposure indicator (EI), when it comes to operational risk? A. A measure of loss experienced by the bank in the past. B. A measure of loss expected by the bank in the future. C. A scale variable, indicating how severe an operational loss could be, if it were to happen in a given business line and/or because of a certain type of risk factor. D. A parameter measuring the correlation among two different business lines and/or risk factors.
46
Questions & Exercises
4. A typical probability distribution for operational losses tends to be… A. …symmetric, because high-frequency, low-impact events are totally balanced by low-frequency, high-impact events; B. …skewed to the right, as it shows both high-frequency, low-impact events and low-frequency, high-impact events. C. … skewed to the left, as it shows both high-frequency, low-impact events and low-frequency, high-impact events. D. … uniform, since you have both high and low impact events, and they all tend to happen with both high and low the same frequencies.
47
Questions & Exercises
5. Consider two business lines, both of which face an equal volume of expected losses (e.g., 100,000 euros) due to operational risk. The former estimates a probability of event (PE) of 1%, while the latter has a PE of 5%. The estimated volatility of Loss Given Event (LGE) is 500 euros for both business lines. Compute and compare the volatilities of the operational losses for the two business lines. What does this example teach us, regarding LFHI and HFLI events?
Top Related