modelling operational risk - univerzita karlovamazurova/operationrisk2016.pdf · 2018-12-17 · 1...
TRANSCRIPT
Modelling Operational Risk
Lucie Mazurova
19.10.2018
1 / 38
Contents
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
2 / 38
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
3 / 38
Operational Risk Definition
Operational risk - risk of losses arising from operation of a company, itdoes not concern the production or services provided by the company (i.e.losses from an insurance portfolio or from a portfolio of bank loans).
OR according to Basel 2
Operational risk is defined as the risk of loss resulting from inadequate orfailed internal processes, people and systems or from external events. Thisdefinition includes legal risk, but excludes strategic and reputational risk.
OR according to Solvency 2
Operational risk means the risk of loss arising from inadequate or failedinternal processes, personnel or systems, or from external events.Operational risk . . . shall include legal risks, and exclude risks arising fromstrategic decisions, as well as reputation risks.
legal risk - includes exposure to fines, penalties or punitive damagesresulting from supervisory actions, as well as private settlements
4 / 38
Operational Loss Event Type Classification
Basel 2:
3 levels
event-type categories → categories → activity examples
Internal fraud(Losses due to acts of a type intended to defraud, misappropriateproperty or circumvent regulations, the law or company policy, whichinvolves at least one internal party)→ Unauthorised Activity, Theft and Fraud
External Fraud(Losses due to acts of a type intended to defraud, misappropriateproperty or circumvent the law, by a third party)→ Theft and Fraud, Systems Security
5 / 38
Operational Loss Event Type Classification
Employment Practices and Workplace Safety(Losses arising from acts inconsistent with employment, health orsafety laws or agreements, from payment of personal injury claims, orfrom diversity / discrimination events)→ Employee Relations, Safe Environment, Diversity andDiscrimination
Clients, Products and Business Practices(Losses arising from an unintentional or negligent failure to meet aprofessional obligation to specific clients, or from the nature or designof a product)→ Suitability, Disclosure and Fiduciary, Improper Business or MarketPractices, Product Flaws, Selection, Sponsorship and Exposure,Advisory Activities
6 / 38
Operational Loss Event Type Classification
Damage to Physical Assets(Losses arising from loss or damage to physical assets from naturaldisaster or other events)→ Disasters and other events
Business disruption and system failures(Losses arising from disruption of business or system failures)→ Systems
Execution, Delivery and Process Management(Losses from failed transaction processing or process management,from relations with trade counterparties and vendors)→ Transaction Capture, Execution Maintenance, Monitoring andReporting, Customer Intake and Documentation, Customer / ClientAccount Management, Trade Counterparties, Vendors and Suppliers
7 / 38
Examples from history
1995 bankruptcy of Barings Bank (founded 1762)- due to unauthorized trading by its head derivatives trader inSingapore, Nick Leeson- failure of internal control, unauthorized trading, internal fraud,external factors (earthquake in Japan)- loss US$1.3 billion - twice the bank’s available trading capital
September 11, 2001 terrorist attack- damage to physical assets, business disruption, dead employees- Bank of New York - loss US$ 140 million
8 / 38
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
9 / 38
Operational Risk in Banks
Basel Comittee for Bank Supervision
The Basel Committee is the primary global standard-setter for theprudential regulation of banks and provides a forum for cooperation onbanking supervisory matters.
- established in 1974 by the central bank governors of the G10 countries- Secretariat is located at the Bank for International Settlements in Basel,Switzerland- 28 members (countries represented by their central banks, EU)- publishes:standards ( BCBS expects full implementation of its standards by BCBSmembers and their internationally active banks)guidelines (elaborate the standards)sound practices (describe actual observed practices)
10 / 38
3 generations of standards
Basel I: the Basel Capital Accord- released 1988- a minimum ratio of capital to risk-weighted assets
Basel II: the New Capital Framework- released 2004, comprehensive document 2006- 3 pillars: minimum capital requirements, supervisory review of aninstitution’s capital adequacy and internal assessment process,effective use of disclosure
Basel III- reacts to financial crisis- enhanced capital requirements, liquidity risk management,systemically important banks, . . .
11 / 38
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
12 / 38
Operational Risk Management
BCBS: Principles for the Sound Management of Operational Risk (2011)
Strong risk management culture
Framework fully integrated into the bank’s overall risk managementprocesses
Governance structure with well defined, transparent and consistentlines of responsibility
Identification and assessment of the operational risk inherent in allmaterial products, activities, processes and systems
Monitoring and reporting
Control and mitigation
Business resiliency and continuity plans
Disclosure
13 / 38
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
14 / 38
Capital Requirement for Operational Risk
Under the Basel II framework, three approaches can be used to quantifythe operational risk annual capital charge.
Elementary approaches
the basic indicator approach (BIA)the standardized approach (TSA)
- use gross income as a volume measure of the exposition to OR
Internal risk measurement system
advanced measurement approach (AMA)
- mathematical modelling of OR losses based on internal and external data
15 / 38
Basic Indicator Approach
Banks using the Basic Indicator Approach must hold capital foroperational risk equal to the average over the previous three years of afixed percentage (denoted alpha) of positive annual gross income.
C tBI =
1
Zt
3∑i=1
α max(GI t−i , 0),
Zt =3∑
i=1
χ[GI t−i>0]
GI j - gross income in year jBased on QISs: α = 0, 15.
GI is net interest income plus net non-interest income (gross of anyprovisions (e.g. for unpaid interest), gross of operating expenses, excludesrealised profits/losses from the sale of securities and extraordinary orirregular items as well as income derived from insurance).
16 / 38
The Standardized Approach
In the Standardised Approach, banks’ activities are divided into eightbusiness lines: corporate finance, trading & sales, retail banking,commercial banking, payment & settlement, agency services, assetmanagement, and retail brokerage.The capital charge for each business line is calculated by multiplying grossincome by a factor (denoted βj) assigned to that business line.
C tS =
1
3
3∑i=1
max
8∑j=1
βj GIt−ij , 0
Values of βj : 0,12 - 0,18.
17 / 38
The Alternative Standardized Approach
Under the ASA, the operational risk capital charge/methodology is thesame as for the Standardised Approach except for two business lines —retail banking and commercial banking. For these business lines, loans andadvances — multiplied by a fixed factor m — replaces gross income as theexposure indicator. The betas for retail and commercial banking areunchanged from the Standardised Approach. The ASA operational riskcapital charge for retail banking:
Crb = βrb mLArb
where m = 0, 35 and LArb are total outstanding retail loans and advances.
18 / 38
Advanced Measurement Approach
Under the AMA, the regulatory capital requirement will equal the riskmeasure generated by the bank’s internal operational risk measurementsystem using prescribed quantitative and qualitative criteria. Use of theAMA is subject to supervisory approval.- qualification criteria for AMA must be fulfilled
Use of data:
internal data- collected over a minimum five-year period- classified according to different business lines and loss-event types- usually truncated by a reporting threshold (e.g. 10000EUR)- for many risk cells contain few low-frequency/high-severity losses ornone
19 / 38
Advanced Measurement Approach
external data- public data and/or pooled industry data- industry data available through external databases from vendors andconsortia of banks-difficult to use directly due to different volumes- survival bias as typically the data of all collapsed companies are notavailable
scenario analysis- in conjunction with external data to evaluate the exposure tohigh-severity events- rough quantitative assessment of the risk frequency and severitydistributions can be obtained- very subjective
20 / 38
Advanced Measurement Approach
business environment and internal control factors
exposure indicators- influence the frequency and severity of losses- e.g. gross income, number of transactions, number of staff and assetvalues
near-miss losses- losses that could occur but were prevented- included in internal datasets to estimate severity of losses butexcluded in the estimation of frequency
21 / 38
Further Development
Standardised Measurement Approach for operational risk- consultative document issued in 2016
withdrawal of internal modelling for operational risk regulatory capital(AMA) from the Basel Framework
- for complexity of the AMA and the lack of comparability arising from awide range of internal modelling practices
introduction of the Standardised Measurement Approach (SMA)
The Business Indicator (BI)- similar to gross income, combines P&L items in different way- multiplied by coefficient dependent on the size of BI (no segmentationinto lines of business)
22 / 38
Further Development
The operational risk capital is determined as follows:
23 / 38
1 Operational Risk Definition
2 Operational Risk in Banks
3 Operational Risk Management
4 Capital Requirement for Operational RiskBasic Indicator ApproachThe Standardized ApproachAdvanced Measurement ApproachFurther Development
5 Loss Distribution ApproachProbability DistributionsModelling Large LossesModelling Dependence
24 / 38
Loss Distribution Approach
Data on OR losses classified according to the above mentioned businesslines and loss-event types.For computing the capital requirement for year t based on the experiencefrom the past T years (T ≥ 5) we have observations
X t−i ,b,lk , i = 1, . . . ,T , b = 1, . . . , 8, l = 1, . . . , 7, k = 1, . . . ,Nt−i ,b,l ,
whereX t−i ,b,lk is the k-th loss of type l in business line b in year t − i ,
Nt−i ,b,l is the number of losses of type l in business line b in year t − i .
25 / 38
Loss Distribution Approach
For each category (i , b, l) there can be a reporting threshold (typically ofthe order of 10000 EUR).
→ X t−i ,b,lk has a distribution truncated from the left (i.e. conditional
distribution (X |X > d), where X ≥ 0 denotes the size of loss withoutreporting threshold).
The aggregate loss in business line b in year t − i is
Lt−i ,b =7∑
l=1
Nt−i,b,l∑k=1
X t−i ,b,lk .
and the aggregate loss in year t − i is
Lt−i =8∑
b=1
Lt−i ,b.
26 / 38
Loss Distribution Approach
The aim is to estimate from data the distribution of total loss in year t,Lt , and to determine an appropriate risk measure for that distribution.ρα - risk measure at confidence level α (typically α between 0,99 - 0,999)Capital requirement: C t
AM = ρα(Lt).We need to know the dependence structure of losses in different cellsdefined by business lines end loss-event types. Simple aggregation ofpartial risk measures gives
C tAM =
8∑b=1
ρα(Lt,b).
It is correct for rhoα = Varα in case of comonotonic losses. It does nottake into account diversification effects.
27 / 38
Risk Measures
Value at risk
ρα(L) = VaRα(L)
VaRα(L) = inf {l ∈ R |P(L > l) ≤ 1− α}
Conditional value at risk
ρα(L) = CVaRα(L) = E (L|L > VaRα(L))
CVaRα(L) = Varα(L) + e (VaRα(L)) ,
where e(u) = E(L− u|L > u) is the mean excess value of the loss abovethe threshold u.
28 / 38
Probability Distributions
For modelling the sumsNt−i,b,l∑k=1
X t−i ,b,lk
a compound distribution can be used. For computing its distributionfunction various recursive methods (e.g. Panjer formula, Fast Fouriertransform), numerical methods or approximations are applicable.
Examples of the most commonly used probability distributions of loss sizesareGamma: f (x) = (x/θ)α e−x/θ
x Γ(α) , α > 0, θ > 0
Lognormal: f (x) = 1√2πσ x
exp
[−1
2
(ln x−µσ
)2], µ ∈ R, σ > 0
Pareto: f (x) = αθα
(x+θ)α+1 , α > 0, θ > 0.
29 / 38
Probability Distributions
Basel committee: ”Observed range of practice in key elements ofAdvanced Measurement Approach (AMA)”(2009)- survey of practice of the banks using AMA approach (or candidates forapproval of AMA approach)
Probability distributions used in OR losses:
30 / 38
Claim Severity Distributions
”body”- the part of distribution describing losses of common size
31 / 38
Claim Severity Distributions
”tail”- the part of distribution describing large losses
32 / 38
Claim Severity Distributions
one distributional model for both common and large losses
33 / 38
Claim Frequency Distributions
34 / 38
Modelling Large Loses
For modelling the tail of the loss distribution (extreme losses) POTmethod based on data exceeding certain threshold is often used.
Generalized Pareto distribution d.f.
Wγ,β(x) = 1− (1 + γ x/β)−1/γ , γ 6= 0
W0,β(x) = 1− exp(−x/β),
where β > 0;x ≥ 0 pro γ ≥ 0,0 ≤ x ≤ −β/γ pro γ < 0.
35 / 38
Modelling Dependence
For modelling the aggregate loss in year t
Lt =8∑
b=1
Lt,b
the joint disribution of losses in different lines of business is needed.Simple aggregation
C tAM =
8∑b=1
ρα(Lt,b)
in case of the risk measure represented by value at risk is correct only forcomonotonic partial losses.To allow for diversification effects, more realistic modelling of dependenceby means of copulas is often used. In the BCBS document on the observedrange of practice from 2009 the following use of copula models wasrecorded:
36 / 38
Modelling Dependence
37 / 38
References
Basel Committee for Bank Supervision (2006)
Basel II: International Convergence of Capital Measurement and Capital Standards:A Revised Framework - Comprehensive Version
http://www.bis.org/publ/bcbs128.htm
Basel Committee for Bank Supervision (2009)
Observed range of practice in key elements of Advanced Measurement Approaches(AMA)
http://www.bis.org/publ/bcbs160b.pdf
Basel Committee for Bank Supervision (2016)
Standardized Measurement Approach for Operational Risk - ConsultativeDocument
http://www.bis.org/bcbs/publ/d355.pdf
Shevchenko, P.V. (2011)
Modelling operational risk using Bayesian inference. Berlin: Springer.
38 / 38