measuring operational risk

MEASURING OPERATIONAL RISK

CHAPTER 11

Management of Financial Institutions by Dr. Meera Sharma

Learning Objectives Operational Risk Data

Loss Events Key Risk Indicators Subjective Risk Assessments

Measuring Operational Risk Top Down Approaches Bottom-up Approaches

Managing Operational Risk Developing an appropriate risk management

environment Risk identification, assessment, monitoring and

control


OPERATIONAL RISK

DEFINITION A wide definition of operational risk is that it

encompasses all risks that a bank faces other than credit and market risks.

A narrow definition, on the other hand, is that operational risk is the risk associated with the operations department of the bank.


OPERATIONAL RISK Incidents of Losses Owing to Operational Risk

In May 2001, a dealer at Lehman Brothers in London traded a £300 million lot instead of an intended £3 million. (Patel 2002).

In 1995 Daiwa Bank reported a $1.1 Billion loss as a result of an internal fraud in its securities trading department. Subsequent punishment by US regulators and loss of reputation led to Daiwa bank having to quit the US market.

In 1995 Barings Bank, UK’s oldest merchant bank, was purchased by Dutch bank ING for just 1 Pound Sterling after sustaining $1 billion of unauthorized trading losses owing to internal fraud by its trader Nick Leeson.


OPERATIONAL RISK

Incidents of Losses Owing to Operational Risk

In 1998 LTCM (Long Term Capital Management) had to be rescued by the Federal Reserve to prevent a systemic crisis. One of the reasons for its failure was inadequate stress testing of its valuation models.

Banker’s Trust, one of the leading banks in the business of offering innovative financial products was sued by 4 of its large clients in 1994 for having misled them about the true risk profiles of its new products. The lawsuits were settled at a loss to Banker’s Trust of $ 171 million.


OPERATIONAL RISK

The New Basel Capital Accord (2003) defines operational risk as

The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.

This definition includes legal risk but excludes strategic and reputational risk.


OPERATIONAL RISK

BANKINGRISKS

MARKET

BUSINESS

OPERATIONAL

CREDIT

CHOSEN RISKS

MANAGEMENT RISKS

CONSEQUENTIAL RISKS


OPERATIONAL RISK

DRIVERS OF INCREASING OPERATIONAL RISK

CHANGING MARKETS; CHANGING PRODUCTS AND SERVICES; CHANGING TECHNOLOGIES, CHANGING TECHNIQUES AND UNEXPECTED EVENTS.


OPERATIONAL RISK

GOALS OF INVESTING IN OPERATIONAL RISK MANAGEMENT

AVOIDANCE OF LARGE UNEXPECTED LOSSES - SEVERITY

AVOIDANCE OF SMALL BUT LARGE NUMBER OF LOSSES - FREQUENCY

IMPROVED OPERATIONAL EFFICIENCY AND RETURN ON CAPITAL


OPERATIONAL RISK

FREQUENCY

SEVERITY

PRIMARY CHALLENGE•CAN PUT BANKS OUT OF BUSINESS•DIFFICULT TO PREDICT AND MANAGE•SIMILAR TO RISKS IN OTHER INDUSTRIES SUCH AS CHEMICAL, AVIATION, HEALTHCARE

SECONDARY CHALLENGE•NOT FIRM THREATENING•CAN BE MANAGED WITH EXPERIENCE•CAN BE INCORPORATED INTO PRICING•GENERATE EFFICIENCY SAVINGS

NOT RELEVANT

DON’T MATTER


OPERATIONAL RISK

OPERATIONAL RISK DATA

Loss Events An operational loss event is an occurrence that

results in a loss owing to operational reasons.

Key Risk Indicators Operational risk indicators are measures that can

signal the potential of loss owing to operational risk


OPERATIONAL RISK

Operational Loss Events Types Identified by the Basel Committee

Internal Fraud: Theft, position mis-reporting and insider trading.

External Fraud: Robbery, forgery, hacking. Employment Practices: Worker

compensation claims, fines for employee health and safety violation.


OPERATIONAL RISK

Operational Loss Events Types Identified by the Basel Committee

Clients, Products and Business Practices: Fiduciary breaches, money laundering, unlawful operations.

Damage to Physical Assets: Terrorism, vandalism, natural disasters.

Systems Failure: Hardware and software failures. Execution, Delivery and Process Management:

Data entry errors, incomplete documentation, collateral management failure


OPERATIONAL RISK

KEY RISK INDICATORS Employee sick days, Staff Turnover, Aggregate grading of employee reviews, Failed background checks on employees, Above market returns, Transaction volumes,


OPERATIONAL RISK

KEY RISK INDICATORS Amount of overtime worked, Investments in technology, System downtime, Age of hardware, Capacity to usage ratio, Margin on a product, Level of training required by internal staff.


OPERATIONAL RISK

CATEGORIES OF OPERATIONAL RISK Technology Risk Human risk Risk from external events Model risk Risk of failed processes Legal risk


OPERATIONAL RISK

CATEGORIES OF OPERATIONAL RISK

Technology Risk:

The risk that banks face owing to advances in technology arises from system breakdowns.

Failure of technology, hardware, software or telecommunication systems is a major cause of operational risk.


OPERATIONAL RISK


Human Risk:

The Basel committee (Working Paper on the Regulatory Treatment of Operational Risk, 2001) defines internal fraud as, “losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy,…”.


OPERATIONAL RISK


Risk from External Events:

This category includes risk owing to external fraud defined by the Basel committee as, “Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party.”

It also includes loss arising from damage to physical property arising from natural or manmade disasters.


OPERATIONAL RISK


Model Risk:

This risk arises from the breakdown of assumptions underlying models of valuation or risk calculation.

It also includes losses from faulty design of products.


OPERATIONAL RISK


Process Failure Risk:

This risk category includes the risk of inadequate or failed processes of execution of transactions, maintenance of transactions or delivery of products.


OPERATIONAL RISK


Legal Risk

Legal risk can arise when the bank breaches contracts it has entered into.

Apart from situations where the bank breaches a contract, legal risk can also arise when a contract entered into by a bank cannot be legally enforced.


OPERATIONAL RISK


-the top down approach

-the bottom up approach.


OPERATIONAL RISK


Top-Down Approaches The top down approach involves first

estimating the risk and the capital required for the bank as a whole

The basic indicator approach The standardized approach in the New Basel

Capital Accord.


OPERATIONAL RISK

The Basic Indicator Approach calculates the operational risk capital charge as 15% of the bank’s average annual gross income over past three years


OPERATIONAL RISK

Gross income is defined asGross income = Net profit + provisions and contingencies + operating

expenses –

reversal during the year in respect of provisions and write-offs made during the previous year(s);

income recognised from the disposal of items of movable and immovable property; realised profits/losses from the sale of securities in the “held to maturity” category; income from legal settlements in favour of the bank; other extraordinary or irregular items of income and expenditure; and income derived from insurance activities (i.e. income derived by writing

insurance policies) and insurance claims in favour of the bank.


OPERATIONAL RISK

The standardized approach involves dividing the bank’s activities into eight business lines

The total capital charge is calculated by summing the capital charge for each business line.

The capital charge for each business line is calculated by multiplying the gross income of that business line by a factor ranging from 12 to 18%.


OPERATIONAL RISK

Business Lines Multiplication Factors

Corporate Finance 18%

Trading and Sales 18%

Retail Banking 12%

Commercial Banking 15%

Payment and Settlement 18%

Agency Services 15%

Asset Management 12%

Retail Brokerage 12%


OPERATIONAL RISK


Bottom-Up Approaches – CHALLENGES

Lack of position equivalence;

Incompleteness of portfolio;

Context dependence and

Irrelevance of past data; and

Validation difficulties.


Historical Database of Key Risk Indicators

Forecasting Model

Estimates of Key Risk Indicators over a future Horizon

Historical Database Loss Event Frequencies Causal

Dependency

Model

Estimates of Loss Event frequencies over a future Horizon

Historical Database of Loss Event Impact

Estimates of Loss Event Impact over a Future Horizon

Aggregate Loss Data over a future Time Horizon

Causal Dependency Model




OPERATIONAL RISK

MEASURING OPERATIONAL RISK Bottom-Up ApproachesGuidelines from Basel Committee – New Accord

It allows banks to use an internal operational risk measurement system provided some qualitative and quantitative criteria are met.

One of these is that the bank should be able to demonstrate that its model captures potentially severe “tail” loss events.


OPERATIONAL RISK

MEASURING OPERATIONAL RISK Bottom-Up ApproachesGuidelines from Basel Committee – New AccordIt should be able to capture loss comparable to a one-

year horizon and 99.9% confidence interval. Its historical loss database should be at least three

years long, extendable to five years. In addition to loss data banks should also capture key

business environment and internal control factors that can change its operational risk profile to make risk assessments forward looking.

measuring operational risk

Business

operational risk drivers

legal risk

reputational risk

operational efficiency

true risk profiles

meera sharma

daiwa bank

innovative financial