Hull J.C. Risk management and Financial institutions
Подождите немного. Документ загружается.
322
Chapter 14
Execution, delivery and process management: Bank of America and Wells
Fargo Bank lost $225 million and $150 million, respectively, from systems
integration failures and transactions processing failures.
Most banks have always had some framework in place for managing
operational risk. However, the prospect of new capital requirements has
led them to greatly increase the resources they devote to measuring and
monitoring operational risk.
It is much more difficult to quantify operational risk than credit or
market risk. Operational risk is also more difficult to manage. Banks make
a conscious decision to take a certain amount of credit and market risk,
and there are many traded instruments that can be used to reduce these
risks. Operational risk, by contrast, is a necessary part of doing business.
An important part of operational risk management is identifying the types
of risks that are being taken and which should be insured against. There is
always a danger that a huge loss will be incurred from taking an opera-
tional risk that ex ante was not even recognized as a risk.
It might be thought that a loss such as that which brought down
Barings Bank was a result of market risk because it was movements in
market variables that led to it. However, it should be classified as
operational risk because it involved fraud by one of its traders, Nick
Leeson (see Business Snapshot 2.4). Suppose there was no fraud. If it was
the bank's policy to let traders take huge risks, then the loss would be
classified as market risk. But if this was not the bank's policy and there
was a breakdown in its controls, then it would be classified as operational
risk. Operational risk losses are often contingent on market movements.
If the market had moved in Leeson's favor, there would have been no
loss. The fraud and breakdown in the bank's control systems would
probably never have come to light.
There are some parallels between the operational risk losses of banks
and the losses of insurance companies. Insurance companies face a small
probability of a large loss arising from a hurricane, earthquake, or other
natural disaster. Similarly, banks face a small probability of a large
operational risk loss. But there is one important difference. When insur-
ance companies lose a large amount of money because of a natural
disaster, all companies in the industry tend to be affected and premiums
rise the next year to cover losses. Operational risk losses tend to affect only
one bank. Since it operates in a competitive environment, the bank does
not have the luxury of increasing prices for the services it offers during the
following year.
Operational Risk 323
14.1 WHAT IS OPERATIONAL RISK?
There are many different ways in which operational risk can be defined. It
is tempting to consider operational risk as a residual risk and define it as
any risk faced by a bank that is not market risk or credit risk. To produce
an estimate of operational risk, we could then look at the bank's financial
statements and remove from the income statement (a) the impact of credit
losses and (b) the profits or losses from market risk exposure. The variation
in the resulting income would then be attributed to operational risk.
Most people agree that this definition of operational risk is too broad.
It includes the risks associated with entering new markets, developing new
products, economic factors, and so on. Another possible definition is that
operational risk, as its name implies, is the risk arising from operations.
This includes the risk of mistakes in processing transactions, making
payments, etc. This definition of risk is too narrow. It does not include
major risks such as the "rogue trader" risk.
We can distinguish between internal risks and external risks. Internal
risks are those over which the company has control. The company chooses
whom it employs, what computer systems it develops, what controls are in
place, and so on. Some people define operational risks as all internal risks.
Operational risk then includes more than just the risk arising from opera-
tions. It includes risks arising from inadequate controls such as the rogue
trader risk and the risks of other sorts of employee fraud.
Regulators favor including more than just internal risks in their defini-
tion of operational risk. They include the impact of external events, such as
natural disasters (e.g., a fire or an earthquake that affects the bank's
operations), political or regulatory risk (e.g., being prevented from operat-
ing in a foreign country by that country's government), security breaches,
and so on. All of this is reflected in the following definition of operational
risk produced by the Basel Committee on Banking Supervision in 2001:
The risk of loss resulting from inadequate or failed internal processes,
people, and systems or from external events.
Note that this definition includes legal risk, but does not include reputa-
tion risk or the risk resulting from strategic decisions.
Some operational risks result in increases in the bank's operating cost
or decreases in its revenue. Other operational risks interact with credit
and market risk. For example, when mistakes are made in a loan's
documentation, it is usually the case that losses result if and only if
the counterparty defaults. When a trader exceeds limits and misreports
324
Chapter 14
positions, losses result if and only if the market moves against the
trader.
14.2 DETERMINATION OF REGULATORY CAPITAL
Banks have three alternatives for determining operational risk regulatory
capital. The simplest approach is the basic indicator approach. Under this
approach, operational risk capital is set equal to 15% of annual gross
income over the previous three years. Gross income is defined as net
interest income plus noninterest income.
1
A slightly more complicated
approach is the standardized approach, in which a bank's activities are
divided into eight business lines: corporate finance, trading and sales,
retail banking, commercial banking, payment and settlement, agency
services, asset management, and retail brokerage. The average gross
income over the last three years for each business line is multiplied by a
"beta factor" for that business line and the result summed to determine
the total capital. The beta factors are shown in Table 14.1. The third
alternative is the advanced measurement approach (AMA), in which the
operational risk regulatory capital requirement is calculated by the bank
internally using qualitative and quantitative criteria.
The Basel Committee has listed conditions that a bank must satisfy in
order to use the standardized approach or the AMA approach. It expects
large internationally active banks to move toward adopting the AMA
Table 14.1 Beta factors in standardized
approach.
Business line
Corporate finance
Trading and sales
Retail banking
Commercial banking
Payment and settlement
Agency services
Asset management
Retail brokerage
Beta factor
18%
18%
12%
15%
18%
15%
12% . ..
12%
1
Net interest income is the excess of income earned on loans over interest paid on
deposits and other instruments that are used to fund the loans (see Section 1.3).
Operational Risk
325
approach through time. To use the standardized approach, a bank must
satisfy the following conditions:
1. The bank must have an operational risk management function that
is responsible for identifying, assessing, monitoring, and controlling
operational risk.
2. The bank must keep track of relevant losses by business line and
must create incentives for the improvement of operational risk.
3. There must be regular reporting of operational risk losses through-
out the bank.
4. The bank's operational risk management system must be well
documented.
5. The bank's operational risk management processes and assessment
system must be subject to regular independent reviews by internal
auditors. It must also be subject to regular review by external
auditors or supervisors or both.
To use the AMA approach, the bank must satisfy additional require-
ments. It must be able to estimate unexpected losses based on an analysis
of relevant internal and external data, and scenario analyses. The bank's
system must be capable of allocating economic capital for operational risk
Figure 14.1 Calculation of VaR for operational risk.
326
Chapter 14
across business lines in a way that creates incentives for the business lines
to improve operational risk management.
The objective of banks using the AMA approach for operational risk is
analogous to their objectives when they attempt to quantify credit risk.
They would like to produce a probability distribution of losses such as
that shown in Figure 14.1. Assuming that they can convince regulators
that their expected operational risk cost is incorporated into their pricing
of products, capital is assigned to cover unexpected costs. The confidence
level is 99.9% and the time horizon is one year.
14.3 CATEGORIZATION OF OPERATIONAL RISKS
The Basel Committee on Bank Supervision has identified seven categories
of operational risk.
2
These are:
1. Internal fraud: Acts of a type intended to defraud, misappropriate
property or circumvent regulations, the law, or company policy
(excluding diversity or discrimination events which involve at least
one internal party). Examples include intentional misreporting of
positions, employee theft, and insider trading on an employee's own
account.
2. External fraud: Acts by third party of a type intended to defraud,
misappropriate property or circumvent the law. Examples include
robbery, forgery, check kiting, and damage from computer hacking.
3. Employment practices and workplace safety: Acts inconsistent with
employment, health or safety laws or agreements, or which result in
payment of personal injury claims, or claims relating to diversity or
discrimination issues. Examples include workers compensation
claims, violation of employee heath and safety rules, organized
labor activities, discrimination claims, and general liability (e.g., a
customer slipping and falling at a branch office).
4. Clients, products, and business practices: Unintentional or negligent
failure to meet a professional obligation to specific clients (including
fiduciary and suitability requirements), or from the nature or design
of a product. Examples include fiduciary breaches, misuse of
confidential customer information, improper trading activities on
2
See Basel Committee on Bank Supervision, "Sound Practices for the Management and
Supervision of Operational Risk," Bank for International Settlements, July 2002.
Operational Risk 327
the bank's account, money laundering, and the sale of unauthorized
products.
5. Damage to physical assets: Loss or damage to physical assets from
natural disasters or other events. Examples include terrorism,
vandalism, earthquakes, fires, and floods.
6. Business disruption and system failures: Disruption of business or
system failures. Examples include hardware and software failures,
telecommunication problems, and utility outages.
7. Execution, delivery, and process management: Failed transaction
processing or process management, and relations with trade counter-
parties and vendors. Examples include data entry errors, collateral
management failures, incomplete legal documentation, unapproved
access given to clients accounts, nonclient counterparty misperform-
ance, and vendor disputes.
Banks must assess their exposure to each type of risk for each of the
eight business lines listed in Table 14.1. Ideally this will lead to a result
where VaR is estimated for each of 7 x 8 = 56 risk-type/business-line
combinations.
14.4 LOSS SEVERITY AND LOSS FREQUENCY
There are two distributions that are important in estimating potential
operational risk losses. One is the loss frequency distribution and the other
is the loss severity distribution. The loss frequency distribution is the
distribution of the number of losses observed during the time horizon
(usually one year). The loss severity distribution is the distribution of the
size of a loss, given that a loss occurs. It is usually assumed that loss
severity and loss frequency are independent.
For loss frequency, the natural probability distribution to use is a
Poisson distribution. This distribution assumes that losses happen ran-
domly through time so that in any short period of time there is a
probability of a loss being sustained. The probability of n losses in
time T is
The parameter can be estimated as the average number of losses per unit
time. For example, if during a 10-year period there were a total 12 losses,
328
Chapter 14
then is 1.2 per year or 0.1 per month. A Poisson distribution has the
property that the mean frequency of losses equals the variance of the
frequency of losses.
3
For the loss severity probability distribution, a lognormal probability
distribution is often used. The parameters of this probability distribution
are the mean and standard deviation of the logarithm of the loss.
The loss frequency distribution must be combined with the loss
severity distribution for each loss type and business line to determine a
total loss distribution. Monte Carlo simulation can be used for this
purpose.
4
As mentioned earlier, the usual assumption is that loss severity
is independent of loss frequency. On each simulation trial, we proceed as
follows:
1. We sample from the frequency distribution to determine the number
of loss events (= n).
2. We sample n times from the loss severity distribution to determine
the loss experienced for each loss event
3. We determine the total loss experienced
When many simulation trials are used, we obtain a total loss distribution.
Figure 14.2 illustrates the procedure. In this example the expected loss
frequency is 3 per year and the loss severity is drawn from a lognormal
distribution. The logarithm of a loss ($ millions) is assumed to have a
mean of 0 and a standard deviation of 0.4. The Excel worksheet used to
produce Figure 14.2 is on the author's website.
Data Issues
Unfortunately there is usually relatively little historical data available
within a bank to estimate loss severity and loss frequency distributions.
Many banks have not kept records of losses arising from different types
of operational risks for different business lines. As a result of regulatory
pressure, they are starting to do so, but it may be some time before a
reasonable amount of historical data is available. It is interesting to
compare operational risk losses with credit risk losses in this respect.
3
If the mean frequency is greater than the variance of the frequency, a binomial
distribution may be more appropriate. If the mean frequency is less than the variance, a
negative binomial distribution (mixed Poisson distribution) may be more appropriate-
4
Combining the loss severity and loss frequency distribution is a very common problem
in insurance. Apart from Monte Carlo simulation, two approaches that are used are
Panjer's algorithm and fast Fourier transforms. See H.H. Panjer, "Recursive Evaluation
of a Family of Compound Distributions," ASTIN Bulletin, 12 (1981), 22-29.
Operational Risk
329
Figure 14.2 Calculation of loss distribution from loss frequency and
loss severity.
Traditionally banks have done a much better job at documenting their
credit risk losses than their operational risk losses. Moreover, in the case
of credit risks, a bank can rely on a wealth of information published by
credit-rating agencies to assess probabilities of default and expected losses
given default. Similar data on operational risk has not in the past been
collected in such a systematic way. It may also be a problem that banks
sometimes conceal a large operational risk loss from the market because
they feel it will damage their reputation.
As indicated above, the Poisson distribution is often used for loss
frequency and the lognormal distribution is often used for loss severity.
Available data is usually used to estimate the parameters of these
distributions. The loss frequency distribution should be estimated from
the bank's own data as far as possible. For the loss severity distribu-
ion, regulators encourage banks to use their own data in conjunction
with external data. There are two sources of external data. The first is
data obtained through sharing arrangements between banks. (The
insurance industry has had mechanisms for sharing loss data for many
330 Chapter 14
years and banks are now beginning to do this as well.) The second is
publicly available data that has been collected in a systematic way by
data vendors.
Both internal and external historical data must be adjusted for infla-
tion. In addition, a scale adjustment should be made to external data. If a
bank with a revenue of $10 billion reports a loss of $8 million, how
should the loss be scaled for a bank with a revenue of $5 billion? A
natural assumption is that a similar loss for a bank with a revenue of
$5 billion would be $4 million. This estimate is probably too small. For
example, research by Shih et al. suggests that the effect of firm size on the
size of a loss experience is relatively small.
5
Their estimate is
Estimated loss for Bank A
= Observed loss for Bank B x
where = 0.23. This means that in our example the bank with a revenue
of $5 billion would experience a loss of 8 x 0.5
0.23
= 6.82 million.
After the appropriate scale adjustment, data obtained through sharing
arrangements with other banks can be merged with the bank's own data
to obtain a larger sample for determining the loss severity distribution.
Public data purchased from data vendors cannot be used in this way
because it is subject to biases. For example:
1. Only large losses are publicly reported, and the larger the loss, the
more likely it is to be reported.
2. Institutions with weak controls are more likely to be represented in
the database because they suffer more losses. Moreover, their losses
tend to be larger.
Public data is most useful for determining relative loss severity. Suppose
that a bank has good information on the mean and standard deviation of
its loss severity distribution for internal fraud in corporate finance, but not
for external fraud in corporate finance or for internal fraud in trading and
sales. Suppose that the mean and standard deviation of its internal loss
severity distribution for internal fraud in corporate finance are $50,000 and
$30,000. Suppose further that external data indicates that for external
fraud in corporate finance the mean severity is twice that for internal fraud
5
See J. Shih, A. Samad-Khan, and P. Medapa, "Is the Size of an Operational Loss
Related to Firm Size," Operational Risk, January 2000. Whether Shih et a/.'s results apply
to legal risks is debatable. It often seems that the size of a settlement in a large lawsuit
against a bank is governed by how much the bank can afford.
Operational Risk
331
in corporate finance and the standard deviation of the severity is 1.5 times
as great. In the absence of a better alternative, the bank might assume that
jts own severity for external fraud in corporate finance has a mean of
2 x 50,000 = $100,000 and a standard deviation of severity equal to
1.5 x 30,000 = $45,000. Similarly, if the external data indicates that the
mean severity for internal fraud in trading and sales is 2.5 times that for
internal fraud in corporate finance and the standard deviation is twice as
great, the bank might assume that its own severity for internal fraud in
trading and sales has a mean of 2.5 x 50,000 = $100,000 and a standard
deviation of 2 x 30,000 = $60,000.
Scenario Analysis
Since historical data is relatively difficult to obtain, regulators encourage
banks to use scenario analyses in addition to internal and external loss
data. This involves using managerial judgement to generate scenarios
where large losses occur. Managers estimate the loss frequency parameter
associated with each scenario and the parameters of the loss severity
distribution. The advantage of scenario analysis is that it can include
losses that the financial institution has never experienced, but, in the
judgement of senior management, could occur. It reflects the controls
in place in the bank and the type of business it is currently doing.
One advantage of the scenario analysis approach is that it leads to
management thinking actively and creatively about potential adverse
events. This can have a number of benefits. In some cases strategies for
responding to an event so as to minimize its severity are likely to be
developed. In other cases, proposals may be made for reducing the
probability of the event occurring at all.
The main drawback of scenario analysis is that it requires a great deal
of senior management time. It seems likely that standard scenarios will be
developed by consultants and by banks themselves to make the process
less of a burden.
14.5 FORWARD LOOKING APPROACHES
Risk managers should try to be proactive in preventing losses from
occurring. One approach is to monitor what is happening at other banks
and try and learn from their mistakes. When a $700 million rogue trader
loss happened at a Baltimore subsidiary of Allied Irish Bank in 2002, risk
managers throughout the world studied the situation carefully and asked: