312 10. Risk Management
and because of the insufficient controlling at Barings in general. While the
perception of operational risk is new in banking, it is rather well known in
industry where often hazardous processes are involved in the production or
transport of goods, e.g. in the chemical industry.
The principal challenges faced when attempting to describe operational
risk are its latent character, the absence of data, and the rarity of high-
impact events. While for market risk, plenty of data are publicly available,
and for credit risk, sufficient data are available in banks internally, there are
very few data available on operational risk. Moreover, data on very large
losses which determine the tail of a loss distribution function, are even rarer.
Worse even, however, for a given bank, stationary data time series may be an
impossibility: Usually risk management is improved, in particular in response
to losses suffered.
The modeling of operational risk comprises two important aspects: (i)
the frequency with which operational losses occur, and (ii) the size (dollar
amount) of the loss suffered in the case of an event. Of course, both quantities
will be stochastic. One therefore is interested in determining their probability
density functions. Many operational risks can be insured. Some inspiration
can thus be gained from the standard model of actuarial science [242]. It
postulates that the frequency of events (insurance claims) in a given time
interval, e.g. one year, is random and drawn from a Poisson distribution. The
distribution of the time interval between two claims then follows an expo-
nential distribution with a well-defined life time. Also the size of insurance
claims is random and drawn from a log-normal distribution!
Data collection therefore is an important focus of operational risk con-
trolling. One typically would build up data bases of operational risk losses
across a bank. When loss data are collected by a single bank, such a data base
is of limited value, though, due to the infrequency of losses. E.g., a typical
number for small banks, say with a balance sheet of 3 ×10
9
Euro as a proxy
for size, is 25 loss events per year in excess of 1,000 Euro. The frequency of
losses increases with the size of the bank, giving good statistics for the largest
banks. These organizations, in practice, are so complex, though, that a sta-
tistical analysis at the highest level of hierarchy is too crude to give reliable
information for risk management.
Data collection can be assisted by including data external to the bank.
There are one or two commercial databases which systematically gather de-
scriptions of those operational loss cases made public, e.g. in the press [241].
As an alternative, homogeneous groups of banks pool their loss data according
to well-defined rules, to increase the data base upon which statistical analyses
can be built, and the statistical significance of the results derived. Examples
known to the author are the ORX (Operational Risk EXchange) consortium
of European banks, the data pooling initiative of savings banks in Germany
led by the German Association of Savings Banks, or a data pooling project led
by the Italian Bankers’ Association. These data bases contain standardized