M|S

Relentless Pursuit of Excellence

INSTRUCTOR’ GUIDELINES

Operational Risk
MSc Financial Services

Maria Siopacha
Academic Year 2018/2019

July 2019
 Agenda

• Definitions
• Standard terminology
• Operational risk measurement
• Examples
• Regulatory landscape

M|S 2
 Recommended reading

• Book 1 Chapter 25

M|S !3
 What is…

• Operational risk (OpRisk) is defined as the risk of loss

resulting from inadequate or failed internal processes,
people and systems, or from external events

- E.g. rogue trading, internal/external fraud,

inadequate computer systems, controls failure,
operations mistake, regulatory effects, natural
disasters, legal risk

• Human factor risk special form of operational risk

• Correlated with reputational risk and losses due to
reputational damage as well as market and credit risks

M|S 4
 Basel classification
• Internal fraud
- Events intended to defraud, misappropriate property, or circumvent
regulations or company policy, involving at least one internal party,
categorised into unauthorised activity and internal theft and fraud

• External fraud
- Events intended to defraud, misappropriate property, or circumvent the law,
by a third party, categorised into theft, fraud, and breach of system security

• Employment practices and workplace safety

- Acts inconsistent with employment, health, or safety laws or agreements,
categorised into employee relations, safety of the environment, and
diversity and discrimination

M|S !5
 Basel classification
• Clients, products, and business practices - conduct/compliance risk
- Events due to failures to comply with a professional obligation to clients, or arising from
the nature or design of a product, including disclosure and fiduciary, improper business
and market practices, product flaws, and advisory activities

• Damage to physical assets

- Events leading to loss or damage to physical assets from natural disasters or other
events such as terrorism

• Business disruption and system failures

- Events causing disruption of business or system failures

• Execution, delivery, and process management

- Events due to failed transaction processing or process management that occur from
relations with trade counterparties and vendors, classified into categories such as
transaction execution and maintenance, customer intake and documentation, and
account management

M|S !6
 Basel II
• Corporate finance
• Trading and sales
• Retail banking
• Commercial banking
• Payment and settlement
• Agency services and custody
• Asset management
• Retail brokerage
M|S !7
 Extended taxonomy

• Classification of OpRisk events can be extended further to

include appropriate risks that match the business line/risk
profile of the organisation

• E.g.
- Market conduct
- KYC/AML, sanctions and anti-corruption
- Data confidentiality and protection
- IT risks
- Valuation, reporting and risk management and control
M|S 8
 OpRisk events
• Conduct risk a major source of loss lately
• Rogue trading
• Fraud
• Data breaches
• Compliance
Source: [Link]
losses-2018

M|S !9
 OpRisk example
• Consider a simple transaction whereby a trader purchases GBP
1mn spot from Bank A

• Current rate is $1.5/GBP (settlement in two business days)

• Bank has to deliver $1.5mn in two days in exchange for receiving
GBP 1mn

• Suppose that our bank wired the $1.5mn to a wrong bank, Bank D
• After two days, our back office gets the money back, which is then
wired to Bank A plus compensatory interest

• The loss is the interest on the amount due

M|S !10
 OpRisk measurement
• Top-down models
- Measure OpRisk at broadest level, using firm-
wide or industry-wide data

• Bottom-up models
- Start at the individual business unit or process
level

- Aggregate results to determine the risk profile of

the institution

M|S !11
 Tools to manage OpRisk
• Audit oversight
• Self-assessment
• Key risk indicators
• Earnings volatility
• Causal networks
• Actuarial models
M|S !12
 Actuarial models
• Actuarial models estimate the objective distribution of
losses from historical data

- Widely used in the industry

- Combine two distributions - loss distribution

approach

- Loss severity: describes the size of the loss once

it occurs

- Loss frequency: describes the number of loss

events over a fixed interval of time

M|S !13
 Loss severity
• Derived from historical data, internal and external
- Define a measure of loss severity at given time

- Loss severity distributions have very long tails,

representing the possibility of very large losses

- Typically Poisson and lognormal distributions are used

• Data can be complemented by simulated scenarios

- Represent plausible and typically large losses that
may not appear in internal or external data

M|S !14
 Loss frequency
• Define the loss frequency distribution by a variable
which represents the number of occurrences of losses
over the period

- E.g. binomial, Poisson, geometric distributions

• Loss severity and loss frequency distributions

combined together

- Can assume independence

- Several techniques, e.g. convolution & tabulation,

copulas

M|S !15
 Total loss
• Derive EL and UL
- EL equals product of expected values of the two
distributions

- Operational VaR is the lowest number such that the

probability is greater than a given level, e.g. 95%

- UL derived as operational VaR less the EL

• Total loss over the period is given by the sum of individual
losses over a random number of occurrences

• Basel II default measure defined as 99.9% VaR over one year

M|S !16
 Example

• Book 1 Section 25.3.2 (Table 25.2) pg. 621

• To print out and do together in class

M|S !17
 OpRisk loss distribution

M|S !18
 Basel capital charges
• Basic Indicator Approach
- Capital charge is a fixed percentage (15%) of the gross income
• Standardised Measurement Approach (SMA)
- Divide bank’s activities into eight business lines
- Capital charge for each business line is a fixed percentage β of its gross income
- β depends on the riskiness of the business line
- Total capital is the sum of the eight regulatory capital charges
• Advanced Measurement Approach (AMA)
- Bank uses an internal statistical model with internal/external data for
estimating the total capital

M|S !19
 Basel III
• BCBS December 2017 publication of Basel III requires regulatory
capital requirements for OpRisks to be determined by the SMA

- To replace the AMA capital regime

• SMA is mainly based on two components:

- A business indicator component

- Utilised as a size proxy for the banks in the SMA context

- Historical loss experience component

- The published framework has a number of parameters that

are subject to national discretion

M|S !20
 Internal model example
• Operational risk is the risk of loss from inadequate or failed
internal internal processes, people or systems of from
external causes

• AMA type model which simulates losses via loss frequency

and loss severity per risk taxonomy, initially calibrated to
internal/external data and expert judgment

• Aggregation of risk taxonomy associated loss distributions

via a dependency model: using a function which represents
the association of two or more variables (copula)

• AMA is typically used for regulatory capital calculations by

banks under Basel II regulation

M|S !21
 OpRisk mitigation
• Internal controls
- Separation of functions

- Dual entries

- Reconciliations

- Tickler systems

- Controls over amendments

M|S !22
 OpRisk mitigation
• External controls
- Confirmations

- Verification of prices

- Authorisation

- Settlement

- Internal and external audits

M|S !23
 OpRisk prevention

Source: INTELLIGENT RISK knowledge for the PRMIA community, April 2019
M|S !24
 Challenges
• Data collection
• Link between risk factors and the likelihood and
size of operational losses not easy to establish

• Very large operational losses that can threaten the

stability of an institution are relatively rare

- Thin tails with small number of observations

- Cannot backtest opRisk models

M|S !25
 Future of OpRisk
management
• Predictive risk intelligence
- Predictive risk analytics, machine learning and artificial intelligence
• Advanced analytics for pattern recognition
- Patterns and behaviours can help organisations understand, manage or
predict the forces that drive them

- Given the nature of OpRisk, even predictable patterns and behaviours can
be challenging to identify consistently

• Correlation and causal analysis

- Understand causal factors influencing current and historical results
Source: [Link]
of-operational-risk-management

M|S !26
 Resources
• Operational risk insights from Director, Operational
Risk Management at Mizuho

- [Link]
insights-from-director-operational-risk-
management-at-mizuho/

• Insight from Global Head of Operational Risk at

HSBC

- [Link]
global-head-of-operational-risk-at-hsbc/

M|S 27
 Recap

• Keywords of the day

M|S !28
 Q&A

Thank you for your

attention!

M|S