Operational risk modeling

See also: Insurance and finance risk analysis modeling introduction

Operational risk is defined in the Basel II capital accord as 'The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events'.

Operational risk includes: internal and external fraud; workers discrimination and health and safety; antitrust, trading and accounting violations; natural disasters and terrorism; computer systems failure; data errors; failed mandatory reporting (e.g. sending out statements or policy documents within a required time); negligent loss of clients' assets, but excludes strategic risk and reputation risk although the latter can be affected by the occurrence of a high-visibility operational risk.

Basel II and various corporate scandals have brought Operational Risk into particular focus in the banking sector where operational risks are required to be closely and transparently monitored and reported. Sufficient capital must be held in reserve to cover operational risk at a high level of certainty to achieve the highest rating under Basel II. Under Basel II's 'Advanced Measurement Approach', which will usually be the least onerous on a bank provided they have the necessary reporting systems in places, operational risk can be modelled as an aggregate portfolio problem similar to insurance risk.

The model Shown below uses a FFT method to calculate the capital required to cover a bank's risks at the 99.9^th percentile level. Basel II allows a bank to use Monte Carlo simulation to determine the 99.9^th percentile but the use of FFT methods is to be preferred over simulation because such a high loss distribution percentile requires a very large number of iterations to determine its value with any precision. The difference between the 99.9^th percentile and the expected loss is called the 'unexpected loss' and equates to the capital charge that the bank must set aside to cover operational risk.

Example model  Operational_risk to determine a financial institution's capital allocation to cover operational risk under Basel II.

The model has assumed that each risk is independent (making a Poisson distribution appropriate to model the frequency, though a Pólya or Delaporte may well be better) and that the impacts all follow a Lognormal distribution. In this model one could have used fitted distribution objects that were linked to the available data. The chief difficulty in performing an operational risk calculation is the acquisition of relevant data that could be used to determine the parameters of the distributions.

More examples related to Basel II can be found in this topic.

Operational risks, especially those with a large impact, occur very infrequently so there is often an absence of any data at all within an individual bank. However, one can base the frequency and severity distributions on general banking industry databases, and use credibility theory (for example, using the Bühlmann credibility factor, Klugman et al (1998)) to gradually assign more weight over time to the individual bank's experience against the industry as a whole.

Credibility theory is often used in the insurance industry when one offers a new policy hoping to attract a particular sector of the population with a known risk level: as a history of claims emerges one migrates from the expected claim frequency and severity to that actually observed.

Read on: Credit risk