Voit J. The Statistical Mechanics of Financial Markets

Подождите немного. Документ загружается.

352 11. Risk Capital

changes of securities recorded for market risk measurements. Prices for secu-

rities are available with frequencies of at least once daily down to one tick

every couple of seconds for the high-frequency data used, e.g., in Chap. 5 for

stock index quotes, and Chap. 6 for foreign exchange. On the other hand,

loss events from operational risk happen quite seldom. A major public sector

bank in Germany with size measured by a balance sheet of 3 × 10

Euro,

e.g., possesses a loss data collection with a few thousand entries, collected

in more than ﬁve years. Typical numbers for German savings banks with a

balance sheet of 3 − 5 ×10

Euro, are about 25–50 loss events per year with

losses exceeding 1,000 Euro. However, capital for operational risk is not held

to cover 1,000 Euro losses but large events, potentially threatening the sur-

vival of the bank. A broad distinction between such events is provided by the

notions of “high-frequency low-impact events” (e.g., cash diﬀerences, typing

errors on the trading desks, retail customer complaints, credit card fraud,

etc.) and “low-frequency high-impact events” (e.g., kidnapping of the chair-

man, ﬁre caused by lightning, rogue traders, unlawful business practices).

In 2004/2005, some banks considered “Spitzer risk”, the risk of New York

federal attorney Elliot Spitzer investigating against them, to be their most

severe operational risk exposure. Given the low probability of large losses,

many more data (or complementary methods of risk estimation) are needed

to capture this range of risk reliably. Regulators indeed require that the ap-

proach of a bank must cover these potentially severe “tail” events, and that

the risk measure is based on a 99.9% conﬁdence level.

The operational risk measurement system of a bank must be granular

enough to determine the risk separately for the eight business lines listed in

Table 11.3, and for seven event categories. These risk categories are listed in

Table 11.4. Basel II also deﬁnes a second and third level of both the business

lines and the risk categories, to make them more granular and more speciﬁc.

They can be found in the Basel document [238]. Banks are free to use their

internal categories for their risk measurement system but must be able to

map their losses onto the Basel categories. Also, a bank may use an internal

Table 11.4. Event-based risk categories of Basel II

Risk Category

Internal Fraud

External Fraud

Employment Practices and Workplace Safety

Clients, Products & Business Practices

Damage to Physical Assets

Business Disruption and Systems Failure

Execution, Delivery & Process Management

11.3 The Regulatory Framework 353

deﬁnition of operational risk but, at the same time, must guarantee that it

covers the same scope as the deﬁnition set forward by the Basel Committee.

At variance with credit risk and best practice in risk management in

general, Basel II requires to hold regulatory capital both against the expected

and unexpected losses from operational risk. Only when it is demonstrated

explicitly that expected losses are included in product pricing, a reduction

of capital to cover solely unexpected losses can be allowed. Unless a bank

has reliable estimates for correlations, based on methodologies approved by

the supervisors, it must add the exposure estimates across business lines and

risk categories. This implies that a perfect correlation is assumed between

events in diﬀerent business lines and risk categories. Several quantitative

models indicate that the capital requirement is essentially determined by

the “low-frequency high-impact” scenarios. For those, the perfect-correlation

assumption certainly leads to a signiﬁcant overestimate of the actual risk

incurred.

The modeling of operational risk must use internal loss data, relevant

external loss data, scenario analysis and factors reﬂecting the business envi-

ronment and internal control systems. Let us discuss the various data types

in some more detail.

An internal loss database certainly is the anchor of every operational risk

management system. It records in detail and in a standardized format every

loss event due to operational risk. From such a loss database, a time series

of losses can be constructed. In principle, this time series can be used for

a risk estimate, in analogy to market risk. One problem with this approach

has been discussed above: usually, there are not enough data available. Sec-

ondly, only for extremely long time series, i.e. when the “low-frequency high-

impact” events have realized suﬃciently frequently, can such a risk estimate

be trusted. Otherwise, one must be concerned about the modeling of these

tail events, i.e. the diﬀerence between loss history and actual risk. Thirdly,

even when such long times series are available, the hypothesis of stationary

environment underlying their use in a risk model, can rarely be justiﬁed in

view of the dynamics of change in the ﬁnancial industry. Fourthly, there is

no forward-looking element in this extrapolation of the past into the future.

On the other hand, after severe loss events, management will usually take the

appropriate measures to prevent a repetition of the event. For these reasons,

the Basel Committee requires the inclusion of additional data types into the

operational risk model.

External loss data can complement internal data. They can help with the

second problem noted before, the capture of “low-frequency high-impact”

events. To the extent that time and ensemble sampling are equivalent, loss

events materialized in another bank are indicative of risk incurred in the own

institute, even though nothing has happened yet. However, the important

challenge with external loss data is to determine the extent to which they are

relevant for the own institute, resp. they can be made relevant by suitable

354 11. Risk Capital

rescaling. At the time of writing, no standard scaling model for operational

risk losses was available. External loss data can be bought from commercial

operational risk databases, or be collected in data consortia. In a commer-

cial database, public information, mostly from the ﬁnancial press, is collected

and analyzed. In a data consortium, a group of banks agrees to contribute

anonymized information on all operational loss events to a central collection

facility. This information is grouped and then reﬂected back to the participat-

ing banks for use in their internal risk models. The importance attached to

such external data in the risk models can be gauged from the fact that even

banks directly competing with each other jointly have set up such data con-

sortia. Without going into details, we add that there is no unique procedure

for blending the internal and external loss data. Hence, a certain element of

subjectivity is introduced in the model.

When performing scenario analysis, experts subjectively evaluate the fre-

quency of a certain scenario, and the losses associated, based on their business

experience and the knowledge of changes which have been introduced as a

reaction to past loss events. The scenarios may either be formulated by the

experts themselves, or be taken from a central scenario pool. Scenario analysis

is a suitable tool to address the all-important “low-frequency high-impact”

events which may have catastrophic consequences for a bank. In scenario

analysis, one deliberately relies on the subjective information provided by

the experts. The aim, though, is to derive almost objective information to be

fed into a risk model. There are several approaches to limit the subjectivity

of the estimates. One is to ask a group of experts, and to require consensus

in the answer. The other one is the Delphi method (named after the famous

greek oracle): Ask the same question to a number of people, then drop the

highest and the lowest answer, and take the average of the rest. Finally, in so-

cial sciences, there is a branch called psychometrics which speciﬁcally deals

with designing and evaluating questionnaires. Scenario analysis is valuable

because it also possesses that forward-looking view which loss data collection

misses. Changes in processes can be incorporated in the estimates a long time

before they show up in changed parameters of a loss history.

The data type of factors reﬂecting the business environment and internal

control systems is rather ill-deﬁned, and is subject of controversy and confu-

sion in the ﬁnancial industry at the time of writing. There are several ways

to evaluate the internal control system of a bank. One way, again, is to ask

experts for an evaluation, e.g., in terms of school marks. While subjective, it

quickly gives valuable information on the state of the controls. Another op-

tion is to systematically record the failure of processes, or process elements.

It is only applicable with highly standardized processes, and economical at

best when both the processes and the failure recording are automated. It is

obvious that such information should be included in a management infor-

mation system. What is less obvious is if and how it could be included in a

quantiative risk model.

11.3 The Regulatory Framework 355

The same can be said about the business environment factors. Several in-

terpretations have been discussed. One is to search for correlations between

operational risk and certain high-frequency business variables such as the

daily number of customer orders to be transmitted to the stock exchange,

the work load of the IT systems, the ﬂuctuation rate of staﬀ, or the number

of excess working hours. Such factors are correlated to operational risk by a

hypothesis about their inﬂuence on the bank’s processes. E.g., the number

of typing errors in the transmission of customer orders could be proportional

to the number of orders. The cost/loss associated with one typing error is N

dollars, on the average. Risk thus could be calculated from these risk indica-

tors, and capital could vary accordingly. The problem with this approach is

that no signiﬁcant correlation between these risk indicators and actual loss

histories could be uncovered to date. Another, perhaps more promising in-

terpretation is in terms of discriminating factors when considering a larger

pool of banks. Such discriminating factors could be the real estate holdings of

a bank (high/low), geographic spread (international/national/regional/city),

the business lines supported, production depth (outsourcing signiﬁcant or

not), etc. While it is not clear how such factors determine the risk model of

an individual bank, they can be used to form peer groups within a pool of

banks, where external data are taken only from institutes of the same peer

group.

It will be interesting to see how these data types are combined in actual

AMA during the next years. At the time of writing, many banks worldwide

were in the process of setting up the quantitative models for their AMA. None

of them has a deﬁnite model yet, and none of them had obtained approval

from its supervisors. Experience with the introduction of internal models in

the area of market risk suggests that initially, the regulators could indeed give

considerable freedom in the model construction and focus primarily on issues

of data quality and completeness. If true, only when a broader experience on

the performance of the various models has become available, stricter guidance

on the structure of the models is expected.

Finally, many credit defaults may be due to operational risk. Examples

are credits obtained in a fraudulent manner, breach of controls in the internal

credit approval process, inappropriate use of the internal rating system with

inappropriate credit pricing as a consequence. Basel II requires these events

to be recorded as operational risk events, but to exclude them from the

operational risk capital calculation. Instead, they should be ﬂagged, and be

included in the credit risk capital charge. This is mainly done to ensure

continuity of the established credit default records.

Pillar 2: Supervisory Review

The ﬁrst pillar of the Basel II regulatory framework requires banks to hold

enough capital to cover that part of their risks which can be quantiﬁed, per-

haps only approximately. The second pillar of banking regulation focusses on

356 11. Risk Capital

the risk management processes and their assessment by supervisory authori-

ties [238]. Some regulators have made the point that it is the risk management

processes that matter, more than the risks themselves.

The supervisory review is based on four key principles. Principle 1 states

that banks should have a process for assessing their overall capital adequacy

in relation to their risk proﬁle, and a strategy for maintaining their cap-

ital levels. The paper also speciﬁes the ﬁve main elements, according to

the Basel Committee, of a rigorous Internal Capital Adequacy Assessment

Process (ICAAP):

• Board and senior management oversight. Basel II emphasizes that the bank

management is responsible for developing the internal capital adequacy as-

sessment process, and for the bank taking only so much risk as the capital

available can support. Conversely, bank management must ensure that the

capital is adequate for the risk taken. Bank management must formulate

a strategy with objectives for capital and risk, including capital needs, an-

ticipated capital expenditures, desirable capital levels, and external capital

sources. Moreover, the board of directors must set the bank’s tolerance for

risk.

• Sound capital assessment. Here, policies and processes must be designed to

ensure that the bank identiﬁes, measures, and reports all materials risks.

Capital requirements must then be derived from the risk to which the bank

is exposed, and a formal statement of capital (in)adequacy must be made.

Notice that no reference is made to regulatory capital or any of the cal-

culation schemes introduced under pillar 1. What is required is the bank’s

own assessment of its capital needs. ICAAP targets economic capital, al-

though this is not spelled out explicitly. The next element requires banks

to quantify or estimate all important risks they are exposed to. To deter-

mine the economic capital, these risks must be aggregated either using a

quantitative (internal) model or by rough estimation. It must be guaran-

teed that the bank operates at suﬃcient levels of capital to support these

aggregated risks. Finally, internal controls, reviews, and audits must ensure

the integrity of the entire management process.

• Comprehensive assessment of risks. The bank must ensure that all signif-

icant risks are known to its management. The notion of risk here is not

limited to those types of risk for which pillar 1 imposes capital charges, and

may include reputational risk, strategic risk, liquidity risk, and ﬁner details

of market, credit, and operational risk which are not covered by pillar 1.

Moreover, this element also requires risk identiﬁcation when a bank uses

one of the standardized, non-risk-sensitive approaches for the determina-

tion of its regulatory capital. When risk cannot be quantiﬁed, risk should

be estimated.

• Monitoring and reporting. The bank should establish a regular reporting

process and ensure that its management is informed in a timely manner

about changes in the bank’s risk proﬁle. The reports should enable the

11.3 The Regulatory Framework 357

senior management to determine the capital adequacy against all major

risks taken, and assess the bank’s future capital requirements based on the

changed risk proﬁle.

• Internal control review. The bank should conduct periodic reviews of its

control structure to ensure its integrity, accuracy, and reasonableness.

Apart the review of the general ICAAP, this process should identify large

risk concentrations and exposures, verify the accuracy and completeness of

the data fed into the risk measurement system, ensure that the scenarios

used in the assessment process are reasonable, and include stress tests.

The second principle asks supervisors to review and evaluate the bank’s

internal capital adequacy assessments and strategies, as well as their ability

to monitor and ensure their compliance with regulatory capital ratios. Su-

pervisors should take appropriate action if they are not satisﬁed with the

results of this process. Again, four elements give more speciﬁc instructions to

supervisors as to how implement this principle.

• Review of adequacy of risk assessment. Supervisors should assess the degree

to which internal targets and processes incorporate all material risks faced

by the bank. The adequacy of risk measures used and the extent to which

they are used operationally to set limits, evaluate performance, and to

control risks, should be evaluated.

• Assessment of the control environment. Supervisors are instructed to eval-

uate the quality of the bank’s management information and reporting sys-

tems, the quality of aggregation of risks in these systems, and the manage-

ments record in responding to changing risks.

• Supervisory review of compliance with minimum standards. In order to

apply certain advanced methodologies such as the IRB approach or the

AMA, banks must satisfy a list of qualifying criteria. Here, supervisors

are instructed to review the continuous compliance with these minimum

standards for the approaches chosen.

• Supervisory response. Supervisors should take appropriate action if they

are not satisﬁed with the bank’s capital assessment and risk management

processes.

According to the third principle, supervisors should expect banks to oper-

ate above the minimum regulatory capital ratios and should have the ability

to require banks to hold capital in excess of the minimum. Here, it is recog-

nized that the pillar 1 capital charges, conservative as they may appear, were

calibrated on the average of an ensemble of banks. The individual capital re-

quirements of a speciﬁc bank may be diﬀerent and are treated under pillar 2.

In particular, regulators may set capital levels higher than the pillar-1 capital

when they deem appropriate for the situation of a bank.

In the fourth principle, supervisors are requested to intervene at an early

stage to prevent capital from falling below the minimum levels required to

support the risk characteristics of a particular bank, and should require rapid

358 11. Risk Capital

remedial action if capital is not maintained or restored. Supervisors have

some options at their disposal to enforce appropriate capital levels. These

may include intensifying the monitoring of the bank, restricting the payment

of dividends, requiring the bank to prepare and implement a satisfactory

capital restoration plan, and requiring the bank to raise capital immediately.

The ultimate threat, of course, is the closure of the bank by the supervisory

authority.

Pillar 3: Disclosure

Banks are required to disclose certain information on their risk management

processes, the risks they face, and the capital they hold to cover it [238]. This

requirement is established to complement pillars 1 and 2.

By pillar-3 disclosure, investors should be enabled to monitor the risk

management of a bank and thus provide incentives for continuous improve-

ment. Investors are assumed to prefer the shares of a bank with good risk

management over one with poor risk management. Rating agencies will more

highly value a bank with good risk management – according to Table 11.2,

the rating score is directly related to the bank’s default probability, and its

creditworthiness. It determines its credit spread on the markets. Pillar 3 thus

is designed to leverage the self-interest of the bank in good risk management.

The Basel II paper has detailed tables with the disclosure requirements

for banks.

11.3.6 Outlook: Basel III and Basel IV

We have not touched upon the deﬁnition of bank capital and the diﬀerent

types of capital existing because this book is focused on the statistical aspects

of banking and risk management. Capital has been deﬁned and classiﬁed in

the Basel I Accord [256, 258]. The capital deﬁnition was left unchanged by

Basel II. It is expected that the next round of Basel negotiations leading to

a Basel III, will provide new deﬁnitions of what constitutes bank capital.

At present, it is not expected that Basel III will fundamentally change the

modeling of banking risks. Only a Basel IV agreement may bring the long-

expected recognition of internal models for credit risk capital determination.

Both the volume of the Basel documents and the length of the negotiation

rounds have increased strongly from Basel I to Basel II. If this trend continues,

the time until the next fundamental innovations in international banking

regulation will likely be measured in decades rather than in years. For the

time being, the preceding sections give a brief though valid introduction.

Appendix: Information Sources

This appendix gives tables of some important information sources relevant

for the topic of this book. Naturally, this list is extremely incomplete. They

were up to date at the time of writing but may become outdated at any

time thereafter. Moreover, they are somewhat biased towards European and

more speciﬁcally German sources. This both reﬂects my own background and

interests but also the fact that much of the research in ﬁnancial markets with

methods from physics actually takes place in the old world. I apologize for

any inconvenience which this bias may cause.

Publications

These basically follow from statistics on the Reference section of this book.

Physics Publications

• Physica A

http://www.elsevier.nl/inca/publications/store/5/0/5/7/0/2/

• European Physical Journal B

http://www.edpsciences.com/docinfos/EPJB/OnlineEPJB.html

• Physical Review E

http://pre.aps.org/

• Europhsics Letters

http://www.edpsciences.com/docinfos/EURO/OnlineEURO.html

• International Journal of Theoretical Physics C

http://www.wspc.com.sg/journals/ijmpc/ijmpc.html

• Nature

www.nature.com

• Physical Review Letters

http://prl.aps.org/

Physics–Finance Interface

• International Journal of Theoretical and Applied Finance

http://www.wspc.com.sg/journals/ijtaf/ijtaf.html

360 11. Appendix: Information Sources

• Quantitative Finance

http://www.iop.org/Journals/qf

Finance

• Journal of Finance

www.afajof.org/jofihome.shtml

• Journal of Banking and Finance

http://www.elsevier.nl/inca/publications/store/5/0/5/5/5/8/

• Journal of Empirical Finance

http://www.elsevier.nl/homepage/sae/econbase/empfin/menu.sht

• Finance and Stochastics

http://link.springer.de/link/service/journals/00780/index.htm

• RISK Magazine

http://www.riskpublications.com/risk/index.htm

• Applied Mathematical Finance

www.tandf.co.uk/journals/routledge/1350486X.html

• Econometrica

http://www.jstor.org/journals/00129682.html

Preprint Servers

• http://xxx.lanl.gov/archive/cond-mat located at Los Alamos Natio-

nal Laboratory is the central preprint server for condensed matter and sta-

tistical physics. Many of the papers published in the physics journals listed

above have appeared on this server before publication, and can be retrieved

there. Some other papers were listed on related servers, such as chao-dyn,

adap-org, or physics. To access these, just replace cond-mat in the

URL above by the appropriate server label.

• http://netec.wustl.edu/, located at Washington University, is a set of

servers with economics related information. BibEc contains information

on printed working papers, WoPEc data about electronic working papers,

WebEc lists World Wide Web resources in economics, and JokEc is a list

of jokes about economists and economics.

Computational Resources

• http://finance.bi.no/~bernt/gcc_prog/algoritms/algoritms/algo-

ritms.html features Financial Numerical Recipes, by Bernt Arne Øde-

gaard. The intentions of this site are clear from its title: To provide an

exhaustive discussion of important algorithms and computer code for ad-

vanced ﬁnancial calculations, in a format that is similar to its big brother:

11. Appendix: Information Sources 361

Numerical Recipes: The Art of Scientiﬁc Computing [174]. It contains algo-

rithms, both basic and advanced, for option pricing, and some algorithms

dealing with term structure modeling and pricing of ﬁxed income secu-

rities. All computer code is in the C++ language, and implemented as

self-contained subroutines that can be compiled on any standard C++

compiler.

• More links to computational resources can be found on the web sites listed

in the following section.

Internet Sites

The central internet sites at the crossroads of physics and ﬁnance are:

• http://www.ge.infm.it/econophysics/, located at the University of

Genova, provides extensive lists of research papers, conferences and schools,

courses, job advertisements, and links to research institutes and companies.

• http://www.unifr.ch/econophysics/ contains news, meeting announce-

ment, book reviews, lists of recent preprints, a “paper of the month”, opin-

ions, and discussions. There is also a page with data sources and access to

ﬁnancial data and links to ﬁnancial institutions. This site is host to the

minority game web site, where plenty of useful information on this game

can be found. There is also an interactive minority game where a visitor

can play against the computer.

• http://www.quantnotes.com is a high-quality (though not always imme-

diately responsive) web site providing selected publications. It features in-

troductory articles where you will learn about various ﬁnancial instruments

and how mathematics you may be familiar with, is applied daily by banks

to fairly price these instruments. In addition, there are book reviews, links

to software and data sites, job and event listings, etc.

• http://www.mailbase.ac.uk/lists/finance-and-physics/ contains a

mailbase for discussion and information exchange.

• Finance-and-Physics-Services at http://l3www.cern.ch/homepages/su-

sinnog/finance/ is another site providing many links, papers, and data

to the public. They have a list of preprints, many of them from the ﬁnance

community, structured along topics. This distinguishes this site from the

three sites above which are more physics oriented. I found particularly

useful the link to http://www.probability.net/ placed on this site in

summer 2000.

I list a few more institutions where further links, working papers on subjects

of interest, etc., can be found:

• www.gloriamundi.org is a site containing a wealth of material on value

at risk and related topics. Many important papers on value at risk are

available for download, and there is a good list of books covering this