“TEN LAWS OF OP RISK”

35. OPERATIONAL RISK

CAPITAL MODELLING
MICHAEL GRIMWADE
HEAD OF OPERATIONAL RISK, ICBC STANDARD BANK
11th DECEMBER, 2023

The contents of this presentation are my own views rather

than those of ICBC Standard Bank.
INTRODUCTION

The first Operational Risk capital models date back to the early to mid-1990s.1 Three decades on, Operational Risk capital modelling
remains a controversial topic, with the use of these models progressing over time from calculating:
 Economic capital during the 1990s; to
 Minimum Capital Requirements with Basel II from 2008; before retreating informally to
 Pillar 2 and stress testing with Basel III from 2023 onwards, and economic capital.

Consequently the focus of this presentation is:

1. The nature of Operational Risk, and how this makes modelling difficult.

2. An overview of Operational Risk capital modelling.

3. The performance of these models during the Global Financial & Euro Crises.

4. What were the root causes of these Operational Risk capital modelling issues?

5. Solutions & conclusions.

Comparing Operational Risk loss data to the Operational Risk capital of banks is challenging, as few banks disclose the value of their
losses. Consequently, this presentation utilises data from 12 G-SIBs that disclose their annual P&L charges for litigation & regulatory
settlements. These charges to the P&L equate to Clients, Products & Business Practices (CPBP), which will typically both be the largest
component of their losses (slide 4), and also some of the largest suffered by these banks (slide 5) and hence are key drivers of Operational
Risk capital requirements. These 12 banks are listed in Appendix I, along with their approaches to Operational Risk capital calculation.
Sources & footnotes:
1. Bankers Trust “…completely overhauled [their] Operational Risk RARoC [Risk Adjusted Return on Capital] during 1992-5 and introduced these upgraded models during the first 1
quarter of 1996”, “Operational Risk and Financial Institutions”, (1998) RiskBooks.
1. THE NATURE OF OPERATIONAL RISK
1. AN OVER-ARCHING FORMULA FOR OP RISK LOSSES
- TEN LAWS OF OPERATIONAL RISK
The foundations for modelling the world around us must be an understanding of its behaviours. Consequently this section begins
with an over-arching formula that describes the Operational Risk losses settling in a particular year in terms of the:
 Frequency of losses, which is the combination of the Occurrence of losses in the current year, and also the Detection of
historical failures / loss events from prior years, and also on-going events;
 Severity of losses, which is the combination of the Duration of an event, and the rapidity with which losses are incurred over
time (Velocity);
 Lags between detection and settlement / recoveries; and
 The Correlations between all of these factors. Internal & external causes, driving Correlations

Over time, Losses settling

≈ = (Occurrence , Detection) x (Duration x Velocity) , Lags
Appetite in a particular year

Preventive Detective Corrective

controls controls controls
The remainder of this section considers five key characteristics of Operational Risk:
1. Frequency - “…a paucity of data” for very large losses;
2. Severity - An “…unusually fat-tailed risk”;
3. Lags - The importance of time, i.e. the significance of lags between detection and settlement / recovery for large loss events;
4. Correlations, driven by internal & external causes; and
5. High degrees of complexity between all of these different components.
2
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
1.1 FREQUENCY - “…A PAUCITY OF DATA…”
The majority of Operational Risk events are low value, i.e. ≤€100k, and arise from either human failures or external fraud. Whilst the
majority of the value of Operational Risk losses are high value events, ≥€10m, and arise from misconduct. The PRA has observed that
for “…very large losses…there is a paucity of data”.1 The ORX data below shows that <1% of events can represent up to 75% of the
total value of losses.
Distribution of the number of losses, by the value of the Distribution of the value of losses, by the value of
individual loss events (1998 to 2018) 2 individual loss events (1998 to 2018) 2

That most losses arise from either human failures or external fraud should influence how frequency is modelled (see section 2).
Sources:
1. PRA, (July 2021) “Statement of Policy The PRA’s methodologies for setting Pillar 2 capital”. 3
2. Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
1.2 SEVERITY - AN “…UNUSUALLY FAT-TAILED RISK”
- THE SIGNIFICANCE OF VERY FAT-TAILED CPBP LOSSES
The PRA has observed that Operational Risk’s “loss distribution is unusually fat-tailed”.1 The chart below illustrates this by analysing
€264bn of losses suffered by ORX members between 2010 and 2018. These losses have been overlaid with the value of 38 very large
losses (≥$1bn), which are in the public domain, suffered by nine member banks. These 38 loss events are primarily CPBP, and whilst they
represent just 0.01% of the total volume of loss events during this period, they are just over 50% of the total value of losses.

The contribution of 38 very large losses ≥$1bn to

ORX members’ losses between 2010 and 2018 2&3

CPBP

Lower value losses or suffered by new members

Sources:
1. PRA, (July 2021) “Statement of Policy The PRA’s methodologies for setting Pillar 2 capital”.
2. Grimwade, M., (December 2021), “Ten Laws of Operational Risk”, Wiley & Sons . 4
3. As ORX reports losses by occurrence date, then the value of the losses attributed to each year may change over time.
1.3 LAGS - THE IMPORTANCE OF TIME
– SIGNIFICANCE OF LAGS BETWEEN DETECTION & SETTLEMENT
Large Operational Risk losses ≥$0.1bn typically exhibit lags between detection and settlement of on average 3 to 4 years, allowing
banks to establish provisions for these losses over this time.
Average durations & lags for 390 losses ≥$0.1bn suffered by 30 current & former G-SIBs (IBM FIRST) 1
Occurrence Detection Settlement
Losses can be steadily provisioned
between detection and settlement CPBP is by far the
$289bn most important risk
category for large
~$1bn losses.

$3bn

$38bn

$32bn

>$1bn

$1bn

Footnote:
[Link] analysis is not weighted for 5
value, see slide 30.
1.4 CORRELATIONS
- RELATIONSHIPS BETWEEN CAUSAL FACTORS
A review of the causes explicitly cited in 16 very
well documented Operational Risk events
reveals on average ~4½ causes per event.
The distribution of these causes is far from
random, however, with the strongest
correlations between causal factors relating to:
1. Strategy, regarding incentives;
2. Culture;
3. Governance;
4. People; and
5. Processes.

Why is this important?

Common to <60%
of incidents in sample These correlations between causal factors may
Common to <40% ultimately influence the existence of
of incidents in sample correlations between the seven Basel II event
Common to <20% categories, which are reflected within
of incidents in sample Operational Risk capital models (see section 2).
6
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
1.4 CORRELATIONS - SENSITIVITY TO ECONOMIC CYCLES
- OPERATIONAL RISK’S MOST IMPORTANT CHARACTERISTIC?
Arguably, Operational Risk’s most important characteristic is that spikes in losses have coincided with economic shocks, most
prominently the bursting of the [Link] bubble in 2001/02, and the Global Financial & Euro Crises from 2007 to 2011. Economic
shocks seem to drive both the Frequency (Occurrence & Detection) and the Severity (Duration x Velocity) of Operational Risk losses.

Analysis of 442 large losses ≥$0.1bn for 30 current & former G-SIBs, analysed by end date
Losses, $billions

Global Financial & Euro Crises

PPI compensation 38%

Rogue & LIBOR fines
Trading, inc
SocGen 9%

MBS MBS 53%

litigation litigation

Inappropriate
foreclosure FX rigging
fines
AML
[Link] bubble
fines
1994 increases in $rates: Enron & Spitzer settlements
• P&G vs BT litigation WorldCom settlements MBS
• Kidder Peabody losses litigation 1MDB
Parmalat settlements Russia : Ukraine
• Orange County’s collapse
Wells Fargo settlement

7
Source: The graph is adapted from Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
1.4 CORRELATIONS - SENSITIVITY TO ECONOMIC CYCLES
- LOSSES COME IN WAVES
After the Global Financial & Euro Crises losses came in waves: first Market, then Credit, and finally Operational Risk, in the form of
P&L charges for litigation & regulatory settlements. This should mean that banks have to hold less capital than would be the case, if
these peaks coincided.
Profile of trading losses (Market Risk), impairments (Credit Risk)
and litigation & regulatory charges (Operational Risk) for 12 banks

Peak
Credit Risk

Peak
Market Risk

Peak
Operational Risk

P&L charges for litigation & regulatory settlements

8
Source: Adapted from Grimwade, M., (2018) “An alternative to SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4.
1.5 HIGH DEGREES OF COMPLEXITY
- A SANDWICH DIAGRAM
Whilst the over-arching formula for Operational Risk is elegantly
simple, it belies significant complexity, which is better illustrated in this
revised bow-tie diagram – a Sandwich Diagram.

 Causes are across the top of this diagram as they can:

- Influence the Occurrence & Detection of events;
- Weaken preventive, detective & corrective controls; and
- Exacerbate Velocity / Severity.
 Correlations exist between causal factors (highlighted in RED).

 Inadequacies or failures that the Basel Committee used to define

Operational Risk describe both the nature of:
- An Operational Risk event; and also
- Control failures (also highlighted in RED).
 Impacts – the wide range of potential impacts influences how the
Severity of Operational Risk losses is modelled (see section 2).

 Time spans the diagram, i.e.:

- Duration is the time between the failure of preventive controls and
the success of a detective control; and
- Lags are the delays in losses crystallising after the success of a
detective control, which can be captured via Basel III (slide 36).

Operational Risk events, controls and impacts are all “sandwiched”

The lines reflect a mis-marking event discovered in February 2008. between causes at the top, and time at the bottom. 9
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
1. CONCLUSIONS

Operational Risk displays a series of behaviours which makes it both significant, but also challenging to quantify, i.e. Operational Risk:

 Is an “…unusually fat-tailed risk” and there is “a paucity of data” relating to these very large loss events, which are the most
important for calculating capital requirements (slide 3 & 4);

 Displays significant lags between detection and settlement / recovery for large loss events, i.e. well beyond Basel II’s 12 month time
horizon (slide 5);

 Is sensitive to economic shocks – this may be Operational Risk’s most important characteristic (slide 7); and

 Exhibits high degrees of complexity – causes are correlated (slide 6) and variously influence the occurrence of events, the
effectiveness of controls and the severity of impacts (slide 9).

The next section provides a brief history of the origins of Operational Risk capital modelling, and an overview of an Operational Risk
capital model.

10
2. AN OVERVIEW OF OPERATIONAL
RISK CAPITAL MODELLING
2. A BRIEF HISTORY OF OPERATIONAL RISK CAPITAL
MODELLING
When banks first began to model Operational Risk, as a component of their economic capital, they utilised actuarial techniques
borrowed from the general insurance industry. Bankers Trust’s Operational Risk capital model was the first to be well publicised. It
was an actuarial model, utilising Monte Carlo simulations, that combined five categories of internal and external Operational Risk loss
data.1 The model was run by the actuarial firm, Tillinghast.

Basel II allowed approved Operational Risk models (Advance Measurement Approaches, AMA) to be used to calculate Minimum
Capital Requirements (Pillar 1), alongside two less sophisticated approaches, TSA and BIA (Appendix II). Regulators did not specify
the precise design of AMA models, and instead there was a culture of allowing banks to innovate, i.e. “letting a thousand flowers
bloom”.2 The Basel Committee also both encouraged banks to move along the spectrum of available approaches over time, and
expected internationally active banks to adopt the more sophisticated approaches, in line with their Operational Risk profiles.

By 2017, however, as part of its post-crisis reforms (Basel III) the Basel Committee proposed the removal of Operational Risk capital
models from the calculation of Pillar 1 capital requirements, replacing all three Basel II approaches with the New Standardised
Approach, but it remained silent on the use of these models for estimating Pillar 2 capital requirements, i.e.:
 Risks not adequately captured under Pillar 1, e.g. emerging risks; and
 Factors external to the bank, e.g. business cycle effects.

Banks originally developed these models to determine their capital adequacy; provide a level playing field for comparing business
performance via Return on Risk Capital; and incentivise businesses to enhance their management of Operational Risk,3 as capital
allocation was based upon their Operational Risk profiles.4

The Operational Risk losses suffered during the Global Financial & Euro Crises emphasised, still further, the significance of this risk
category. Consequently, banks are likely to continue to use their models for both regulatory capital, although for Pillar 2, rather than
Pillar 1, and also for economic capital.
Sources & footnotes:
1. The five categories were: Relationship Risks; People / Human Capital Risks; Technology & Processing Risks; Physical Risks; and Other External Risks (“Operational Risks and
Financial Institutions”, (1998) RiskBooks).
2. This is a misquote of Mao Tse-tung from a speech that he gave on 27th February 1957 to the Supreme Council in which he said “let a hundred flowers bloom”. 11
3. The allocation of Operational Risk capital to businesses at Bankers Trust was leveraged if they failed to close their Internal Audit actions on a timely basis.
4. “Operational Risks and Financial Institutions”, (1998) RiskBooks.
2. A BRIEF HISTORY OF OPERATIONAL RISK CAPITAL
MODELLING
Two decades after the finalisation of Basel II, which included AMA, it will be replaced by Basel III, which removes these Pillar 1 models.
As the timeline below shows, unfortunately for AMA, its launch coincided with the Global Financial & Euro Crises.
[Link] Global Financial COVID-19
bubble & Euro Crises

1 2

Footnotes:
1. The total capital resources of Baring Bank at the time of Nick Leeson’s £827m of rogue trading losses were just £412.5m.
2. SocGen initiated a €5.5bn rights issue 2½ weeks after the announcement of these losses. 12
3. External Fraud losses suffered by ORX’s members increased to €4.1bn in 2020 against the average for the previous five years of €2.1bn. (ORX, (2021) “Annual Banking Loss Report”).
2. AN OVERVIEW OF AN OPERATIONAL RISK CAPITAL MODEL
- KEY COMPONENTS
Operational Risk capital models separately analyse the frequency and severity of loss events. Banks typically use for:
 Frequency: A single distribution (Poisson) to model the frequency of their internal loss data.1 & 2
 Severity: Multiple different distributions are typically used to model the severity of impacts. This may reflect the wide variations in
the scale of different impacts of events (e.g. Market Risk losses, compensation, and regulatory fines etc).
The loss data used in these models range between just internal loss data, as well as, scaled external data (Loss Distribution Approach,
LDA, models) to just scenarios, as well as, combinations of both (hybrid models). Whilst the combination of different internal and
external events within some individual Basel categories, may explain why many banks also utilise different distributions for the body
(commonly log normal) and the tail (commonly generalised Pareto) of some of their severity distributions.
Loss distributions for each risk: Once the separate frequency and severity distributions are combined into loss distributions via a
Monte Carlo simulation, then banks can overlay risk mitigation / transference from relevant insurance policies (see Appendix III).
Correlations / diversification: The different loss distributions are then combined with consideration to the existence of correlations,
which for very large loss events may reflect the influence of different underlying causal factors, and also external drivers relating to
detection and / or settlement. Correlations, can be either calculated from:
 Internal data, if firms have sufficient number of loss events, although this will be biased towards higher frequency events; or
 External data, e.g. ORX’s dataset; or
 Tail events by selecting a population of peer banks, and analysing large losses, which can be sourced from both ORX News and IBM
FIRST. This can involve analysing the frequency with which individual banks suffer multiple large loss events in the same year; or
 Estimates: Firms can estimate the correlations between different risk types by considering their sensitivities to causal factors.
The loss distributions for the different risks are then aggregated using a non-Gaussian, non-normal distribution. The EBA suggests
firms use T-copulas with low degrees of freedom, “…say 3 or 4…”.
Diversified capital requirement for AMA banks is the combination of expected and unexpected losses, unless banks can adequately
demonstrate that their expected losses are captured in their internal business practices, e.g. their budgeting and / or product pricing.
Sources & footnotes: 13
1. The Basel Committee’s 2008 Survey of AMA banks reported 93% usage of Poisson (Basel Committee, (July 2009) “Observed range of practice in key elements of …AMA.”)
2. The convergence on the same frequency distribution may reflect that most Operational Risk loss events arise from either human failures or external fraud.
2. AN OVERVIEW OF AN OPERATIONAL RISK CAPITAL MODEL
The diagram below illustrates the key components of an Operational Risk capital model. It has been annotated for the values of the
inputs and the outputs, i.e. scenarios are likely to be to the nearest million or tens of millions, whilst the model may calculate the
99.9th percentile to the nearest €, i.e. the outputs from these models are spuriously more precise than the inputs!
An overview of an Operational Risk capital model

 Loss data: ≥€10k; and / or

 Scenarios: ~€ms to €10ms

Capped at 20% Diversification Capital: to the

benefits of nearest €1
 Loss data: ≥€10k; and / or 20% to 40%
in practice
 Scenarios: ~€ms to €10ms
14
Source: This diagram is adapted from Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
2. CONCLUSIONS

Banks originally developed Operational Risk capital models to:

 Determine their capital adequacy;
 Provide a level playing field for comparing business performance via Return on Risk Capital;1 and
 Incentivise businesses to enhance their management of Operational Risk.

The Basel Committee decided to incorporate Operational Risk into the prudential framework because it recognised that the “…growing
importance of this risk category…” meant that it was “…too important not to be treated separately within the capital framework.” 2

Actuarial techniques, borrowed from the general insurance industry, were utilised to model Operational Risk. This involved separately
modelling the frequency and severity for the different risk categories, prior to combining them into loss distributions.

Some of the characteristics of Operational Risk, described in section 1, however, would make its modelling difficult in practice, i.e.: the
combination of the paucity of data for very large losses, which drove a reliance on external data and / or scenario analysis, introducing
subjectivity; its unusually fat-tailed loss distributions; and its sensitivity to economic shocks.

Unfortunately, the launch of the modelling of Operational Risk to calculate Pillar 1 capital requirements in January 2008 coincided with
the beginning of the Global Financial Crisis, which would highlight some of these modelling challenges. In terms of the credibility of
these models, it was unhelpful that less than three weeks after their launch, SocGen suffered a €4.9bn rogue trader event, which
significantly exceeded its AMA Operational Risk requirement of €3.6bn, and necessitated a €5.5bn rights issue two & a half weeks later,
i.e. this event, that was seemly well beyond 1 in 1,000 years, occurred within the first three weeks of Basel II.

The next section considers in more detail how the Basel II Operational Risk capital regime responded to the Global Financial & Euro
Crises. Its performance during this period would subsequently lead to its rapid demise, with the introduction of Basel III.
Sources & footnotes:
1. Some businesses primarily expose banks to Operational Risk, e.g. asset management, agency services, payments & settlements, and corporate finance. The absence of
Operational Risk from RAROC calculations, means that the return of these businesses on economic capital would be near infinite! 15
2. Basel Committee, (June 1999) “A new capital adequacy framework, consultative paper”.
 3. THE PERFORMANCE OF THESE MODELS
DURING THE GLOBAL FINANCIAL & EURO CRISES
3. INTRODUCTION - “BATTLE PLANS RARELY SURVIVE FIRST
CONTACT WITH THE ENEMY” 1
This section considers how these Pillar 1 Operational Risk capital models actually behaved when they came face-to-face with the
Global Financial & Euro Crises:

1. The P&L performance of 12 G-SIBs during the Global Financial & Euro Crises.

2. Operational Risk’s response to the Global Financial & Euro Crises.

3. The relationship between Operational Risk losses and AMA Operational Risk capital.

4. The annual changes to Operational Risk capital requirements of nine AMA banks from 2008 to 2016.

5. Case studies:

1. Changes in Operational Risk capital for an LDA model – before and after these crises; and

2. Change in Operational Risk capital for a hybrid model over time.

 Conclusions.

Footnote:
1. This is a common paraphrasing of a quote from Field Marshal Helmuth Moltke “…no plan of operations extends with any certainty beyond the first contact with the main 16
hostile force”. Moltke masterminded the Prussian invasion of France during the Franco-Prussian War.
3.1 P&L PERFORMANCE OF 12 G-SIBs DURING THE GLOBAL
FINANCIAL & EURO CRISES
Operational Risk losses are typically absorbed by operating P&L, but during economic shocks the profitability of banks may already be
reduced by Credit & Market Risks. Between 2008 and 2016 there were 22 occasions when one of a sample of 12 banks was loss making.
On six occasions it was Operational Risk losses, in the form of P&L charges for litigation & regulatory settlements, that pushed these
banks into loss, i.e. without surplus capital, these Operational Risk losses would have required additional capital to be raised.

Analysis of profit before tax of 12 current & former G-SIBs from 2008 to 2016 1
Profit / (loss) before tax, €billions 40

30

20

10

On six occasions it is
Operational Risk losses, in
-10 the form of litigation &
regulatory settlements
-20 charges, which tip these
banks into loss, i.e. ~5%
of the time.
Source: -30 17
th
1. Grimwade, M., (13 July 2017) “Fixing Operational Risk Capital”, Institute of Operational Risk Breakfast Seminar.
3.2 OPERATIONAL RISK’S RESPONSE TO THE GLOBAL
FINANCIAL & EURO CRISES
Overlaying changes in losses ≥$0.1bn suffered by the G-SIBs pre & post the Global Financial & Euro Crises, on the over-arching
formula for Operational Risk (slide 2) reveals how Operational Risk responded to this economic shock, i.e. Occurrence & Detection,
Duration, Velocity, and Lags all increased.

An overarching formula for Operational Risk losses settling in the current year

Frequency Severity

Over time Losses settling

≈ = (Occurrence + Detection) x (Duration x Velocity) , Lags
appetite in a particular year

Ratio of large losses (≥$0.1bn) pre & post the 1.3x 2.3x
Global Financial Crisis i.e.

2007 to 2017 vs 1996 to 2006 3.2x 2.9x 1.6x

Overall increase ~9.3x

18
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
3.3 THE RELATIONSHIP BETWEEN OPERATIONAL RISK LOSSES
AND AMA OPERATIONAL RISK CAPITAL
As a result of this spike in losses, in the aftermath of the Global Financial & Euro Crises, the levels of Operational Risk capital for nine
banks, that were consistently AMA throughout the period, increased by 64%. The ratio of P&L charges for litigation & regulatory
settlements1 in the following year2 to capital starts at a mere ~5% in 2008 / 09 and peaks at above 50% in 2014.
Analysis of Pillar 1 Operational Risk capital and litigation charges
for the nine AMA banks between 2008 and 2016
40

litigation charges, €billions

Op Risk capital requirements or Operational Risk capital continued
30 to rise despite litigation charges
beginning to fall.

20 This may reflect the loss

experiences of individual banks,
rather than all nine.
10

Pillar 1 Operational P&L charges for litigation &

Footnotes: Risk capital regulatory settlements
1. Slides 4 & 5 demonstrate that these CPBP losses represent the most material Operational Risk losses. 19
2. The Operational Risk capital requirement at the end of one year is intended to absorb losses suffered during the following year.
3.4 ANNUAL CHANGES IN OPERATIONAL RISK CAPITAL
REQUIREMENTS OF NINE AMA BANKS FROM 2008 TO 2016
In aggregate the levels of Operational Risk capital rose remorselessly in the aftermath of the Global Financial & Euro Crises, although,
surprisingly 1/3rd of the time individual bank’s capital requirements actually fell! For this sample, scenario based models, seem to have
been more stable than LDA models. This may reflect that these scenario based models included some risks that were absent from the
historical loss data.
Analysis of annual changes in Pillar 1 Operational Risk capital for the nine AMA banks from 2008 to 2016 1
Scenario
Number of occasions AMA
capital went either down or up

based models Some of the large movements variously coincide with:

were more • The occurrence of very large losses; or
stable than • Acquisitions; or
LDA models • Switches of acquisitions from TSA to AMA.

Coincides with a LIBOR

settlement and an
increase in PPI
provisions

1. Buckets of % movements of Op Risk

capital for individual AMA firms
Source: 20
1. Grimwade, M., (13th July 2017) “Fixing Operational Risk Capital”, Institute of Operational Risk Breakfast Seminar.
3.5 CASE STUDY 1 – AN LDA MODEL
- OPERATIONAL RISK LOSSES & CAPITAL – BEFORE - 2006
For one bank, with an LDA model, the pre-crisis relationship between large losses and capital can be seen by comparing, a decade of
large losses ≥$0.1bn to its reported Operational Risk economic capital of $5.7bn in 2006.1

Illustration of a loss distribution overlaid on a bank’s large losses (≥$0.1bn)

from 1997 to 2006 and its economic capital in 2006 1

50th
percentile

Ratio of Operational Risk capital : largest loss:

1997 to 2006 = $5.7bn1 / $2.7bn = 2.1 x

90th
percentile
99.9th
percentile

$5.7bn
Source: Number of loss events
1. The 2006 Operational Risk capital number is economic rather than regulatory capital but is “based upon actual losses and potential scenario-based stress losses, with adjustments to
the capital calculation to reflect changes in the quality of the control environment or the use of risk-transfer products. The Firm believes its model is consistent with the new Basel II 21
Framework and expects to propose it for qualification under the Basel II advanced measurement approach…” (page 63 of JP Morgan Chase’s 2006 Financial Statements).
3.5 CASE STUDY 1 – AN LDA MODEL
- OPERATIONAL RISK LOSSES & CAPITAL – AFTERMATH - 2016
Extending this analysis to 2016 for this US bank reveals that its AMA Operational Risk capital increased by ~5½x to $32bn, in line
with the increase in its largest loss, which increased by ~5x from $2.7bn to $13bn.

Illustration of a loss distribution overlaid on a bank’s large losses (≥$0.1bn)

from 1997 to 2016 and its regulatory capital in 2016 1

50th
percentile

Ratios of Operational Risk capital : largest loss:

2007 to 2016 = $32bn / $13bn = 2.5 x

1997 to 2006 = $5.7bn1 / $2.7bn = 2.1 x

90th
percentile
99.9th
percentile

>$30bn
Number of loss events

Source: 22
1. Grimwade, M., (2018) “An alternative to SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4.
3.5 CASE STUDY 2 – A HYBRID MODEL
- OPERATIONAL RISK LOSSES & CAPITAL – 2008 to 2016
Whilst this analysis for a bank with a hybrid AMA model, again illustrates how the Operational Risk capital requirements generated by
some AMA models prior to the Global Financial & Euro Crises underestimated exposures from litigation & regulatory settlements.

Analysis of Pillar 1 Operational Risk capital vs P&L charges for

litigation & regulatory settlements for the following year 1
5.0
litigation charges, £billions
Op Risk capital requirements or
The switch from AMA to TSA
Move from coincides with a ~25% increase in
AMA to TSA 2 Operational Risk capital.

2.5 This is within the maximum

3
Acquisition discount of AMA to TSA allowed
driven under Basel II (see slide 27).
increase

£bns
Following year’s P&L charges for litigation & regulatory settlements, £bns
Sources & footnotes:
1. The Operational Risk capital requirement at the end of one year is intended to absorb losses suffered during the following year, Grimwade, M., (2018) “An alternative to
SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4.
2. “As part of the integration programme, Lloyds Banking Group is in the process of moving toThe Standardised Approach…”, Lloyds Banking Group’s 2010 Pillar III disclosure.
3. “Despite an increase in the number and severity of Operational Risk events during the Financial Crisis, capital requirements have remained stable or even fallen for the 23
standardized approaches.” Basel Committee, (October 2014) “Revisions to the simpler approaches” .
3. CONCLUSIONS

The Operational Risk losses suffered by banks during the Global Financial & Euro Crises, were an order of magnitude larger than the
losses suffered during the preceding decade (slides 7 & 19).

This was unexpected in terms of both the occurrence of these economic shocks1 and also the sensitivity of Operational Risk losses. The
scale of losses across all risk types meant that between 2008 and 2016 a sample of 12 current & former G-SIBs, were loss making
approx. 20% of the time (slide 17), and ~5% of the time Operational Risk losses, in the form of P&L charges for litigation & regulatory
settlements, was the difference between profit or loss.

In response, the Operational Risk capital requirements generated by a sample of nine AMA banks increased by a total of 64% (slide 19).
For one particular bank, with an LDA model, the ~5½ -fold increase in its Operational Risk capital requirement coincided with a
comparable ~5-fold increase in its largest loss experience (slides 21 & 22).

The responses of these AMA models did seem to vary, however, depending on their methodology, i.e. scenario based models seemed
to be more stable than LDA models (slide 20). This may reflect that these scenario based models included some risks that were absent
from the historical loss data.

Superficially these AMA models responded to the Global Financial & Euro Crises in a “risk-sensitive” way, as the Basel Committee had
always intended.2 The problem, however, is that the Global Financial & Euro Crises highlighted the extent to which these model had
under-estimated the Operational Risk profiles of the G-SIBs. This was despite these models having been subject to extremely extensive
validation, as part of the AMA waiver application process, i.e. they did not fail due to a lack of documentation etc! Consequently, the
root causes of this issue are explored in detail in the next section.
Sources & footnotes:
1. In his March 2007 budget speech the then Chancellor of the Exchequer, Gordon Brown, stated that “…we will never return to the old boom and bust.” (Reuters, (21st March
2007) “Gordon Brown's 2007 budget”.) 24
2. Basel Committee, (June 1999) “A new capital adequacy framework, consultative paper”.
4. WHAT WERE THE ROOT CAUSES
OF THESE ISSUES?
4. INTRODUCTION

This section considers the root causes of the issues experienced by the Basel II Operational Risk capital framework during the Global
Financial & Euro Crises:

1. The divergence between AMA and TSA.

2. The “under-calibration” of Operational Risk capital.

3. “Letting a thousand flowers bloom” - a wide range of AMA practices led to divergent RWAs.

4. Ignoring the importance of time:

− Losses can be paid out over many years; and
− Different risks display different lags.

5. Model sensitivities to scenario estimates.

6. A failure of Operational Risk management, not measurement?

 Conclusions.

25
4.1 DIVERGENCE BETWEEN AMA AND TSA
The PRA has noted that “During the recent economic downturn, incomes dropped but operational risk exposures, in many cases,
remained the same or increased.”1 That an economic shock would lead to increased Operational Risk losses and AMA exceeding TSA
capital requirements was not unknown prior to the Global Financial & Euro Crises. The chart below is my “recollection” of a memo
that I wrote in March 2008, in which I prophetically noted that as a consequence of an economic slowdown:
 “AMA capital requirements may rise, reflecting…more volatile markets, escalating fraud and claims of mis-sale…”; whilst
 “TSA capital requirements may be flat or fall due to static or declining income.”
The AMA and TSA capital projections of a bank, in 2007
Operational Risk, RWAs

AMA with ‘shock’

TSA

AMA

2006 2007 2008 2009 2010

Having approaches for calculating Pillar 1 Operational Risk capital requirements that predictably move in opposite directions in
response to the same economic conditions was clearly problematic for Basel II.
Source: 26
1. PRA, (July 2021) “Statement of Policy The PRA’s methodologies for setting Pillar 2 capital”.
4.2 THE “UNDER-CALIBRATION” OF OPERATIONAL RISK CAPITAL

The Basel Committee ran two Quantitative Impact Studies (QIS) for Operational Risk. The data collected was typical of the 1990s,
but unfortunately lags in the settlement of losses, associated the bursting of the [Link] bubble, meant that some very large losses
were not captured. Although these losses would still have been dwarfed by those of the Global Financial & Euro Crises.

Analysis of Operational Risk large losses ≥$0.1bn suffered by 30 current & former
G-SIBs from 1990 to 2005 in terms of both end date & settlement date 1 In September 2001 the Basel
16 Committee:
Enron’s collapse Average lags for
Losses, $billions

& bursting of the large Op Risk losses

[Link] bubble
are 3 to 4 years. • Reduced its estimate for Operational
WorldCom’s
12 collapse Risk capital from 20% (but see slide
35) to 12% of Minimum Regulatory
Capital (MRC).
Enron & WorldCom
settlements
8 • Set a floor for AMA at 25% below
TSA, i.e. 9% of MRC.2 (see slide 23).
Spitzer
settlement
1st WorldCom
Parmalat’s
settlement In October 2014, the Basel Committee
4 Barings’ collapse observed that AMA capital requirements
£827m of
rogue trading were “often benchmarked against this
losses
under-calibrated [TSA] capital
requirement.” 3
Sources & footnotes:
[Link] from the Institute of Operational Risk’s response to the
Basel Committee’s SMA consultation paper (2nd June 2016).
QIS 2 LDCE [Link] Committee, (September 2001) “Working Paper on the
Regulatory Treatment of Operational Risk”. 27
[Link] Committee, (October 2014) “Consultative Document:
Operational Risk – Revisions to the simpler approaches”.
4.3 “LETTING A THOUSAND FLOWERS BLOOM”
- A WIDE RANGE OF AMA PRACTICES LED TO DIVERGENT RWAs
As noted on slide 11, AMA’s principles-based framework was established with a significant degree of flexibility, which would narrow
over time, as best practice emerged. An initial wide range of internal modelling practices resulted in a lack of comparability of capital
requirements.1 This is illustrated in the chart below. Anecdotally, however, AMA modelling practices were converging as the Basel
Committee was considering withdrawing these models from Pillar 1 capital calculations.

Comparison of Operational Risk capital in 2016 vs peak and average litigation settlements 2
35
Losses in €billions
30
Ratios for peak P&L charges for litigation &
25
regulatory settlements vs
20
Operational Risk capital range from 1½ to 7
Historical loss data
15 appears less influential
10 BNP No relationship between
Paribas capital & losses
5

Sources: Peak litigation & regulatory settlements Average litigation & regulatory settlements, 2008 to 2016
1. Basel Committee, (June 2016) “Consultative Document Standardised Measurement Approach for operational risk”. 28
2. Grimwade, M., (2018) “An alternative to SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4.
4.4 IGNORING THE IMPORTANCE OF TIME
- LOSSES CAN BE PAID OUT OVER MANY YEARS
Lags in the payment of compensation for PPI have resulted in on-going P&L charges over a nine year period. These losses clearly extend
beyond the 12 month time horizon envisaged by Basel II. The chart below shows the PPI related P&L charges incurred by Lloyds Banking
Group (LBG), and is annotated to illustrate two alternative approaches to reflecting these losses in a capital model. 1

Two alternative approaches to representing LGB’s PPI P&L charges in a capital model 2&3
25
2. Alternatively, LGB could
P&L charges, £billions

represent its PPI P&L

20 charges as a single loss
event of £21.9bn, which
would be equivalent of ~53%
15 of LBG’s total capital
resources.

10 For context, in 2022, LBG’s

Pillar 1 capital requirements
1. Nine individual loss P&L charges, with an average value of £2.4bn. were just:
5  £2bn for Operational
Risk; and
 £14.9bn for all the other
risks combined.

Sources:
1. The Basel Committee’s solution to this issues is explained on slide 36.
2. LBG’s Financial Statements, Other Provisions, for 2011 to 2019. 29
3. Adapted from Grimwade, M., (13th July 2017) “Fixing Operational Risk Capital”, Institute of Operational Risk Breakfast Seminar.
4.4 IGNORING THE IMPORTANCE OF TIME
- DIFFERENT RISKS DISPLAY DIFFERENT LAGS
Lags between detection and settlement vary widely between different categories of Operational Risk:
 For the six Basel event categories, excluding CPBP, the majority of the value of losses crystallise within year one of detection; whilst
 CBPB losses show long lags, and they are longest for losses that are sensitive to economic shocks.

Analysis of lags for different categories of Operational Risk losses 1

Operational Risk losses, £billions

60% of losses by value are:

 The six Basel event categories,
excluding CPBP (8%);
 CPBP that are insensitive to
economic shocks, e.g. breach of
sanctions and benchmark
manipulation (36%); and
 CPBP losses that are sensitive to
economic shocks and which
crystallised within one year (16%).2

Sources & footnotes:

1. Grimwade, M., (2018) “An alternative to SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4. 30
2. The remaining 40% are CPBP losses that are sensitive to economic shocks, and that crystallised into losses more than one year after detection.
4.5 MODEL SENSITIVITIES TO SCENARIO ESTIMATES
The “paucity” of very large Operational Risk loss events, means that scenarios are often used to plug gaps in the data. Unfortunately humans
are not very good at estimating the likelihoods of remote events, and capital models can also be very sensitive to these inputs, owing to
Operational Risk being “unusually fat-tailed”. Conducting sensitivity analysis (+/- 10%) on the severity of scenarios reveals that whilst:
 Scenarios with higher likelihoods are less inaccurate, but small variations can have disproportionate impacts at 99.9 th percentile; and
 Scenarios with lower likelihoods are even harder to estimate, but the model is less sensitive to variations in these model inputs.
Consequently, banks may have to reverse engineer their scenarios, whilst staying within an acceptable range, in order to obtain meaningful
outputs (Appendix IV).
Illustration of the sensitivity of the capital outputs for scenarios with different likelihoods
 Lower levels of
scenario
inaccuracy; but also
 Higher levels of
model sensitivity.

Much lower levels of both:

 Scenario accuracy; but
also
 Model sensitivity.
31
Key: The area is proportionate to the model’s sensitivity to these scenarios at 99.9th percentile for +/- 10% moves in severity.
4.6 A FAILURE OF OPERATIONAL RISK MANAGEMENT, NOT
MEASUREMENT?
That the Operational Risk capital requirements generated by AMA models increased in response to rising losses was to be expected.
So perhaps the real failures of this period actually relates to Operational Risk management, rather than measurement, due to the
failure to detect a number of on-going events and also to prevent the occurrence of new material events, as can be seen below and in
slide 5.

On-going
Operational Risk events

Newly occurring
Operational Risk events

32
Source: Adapted from Grimwade, M., (2016) “Managing Operational Risk: New Insights & Lessons Learnt”, RiskBooks.
4. CONCLUSIONS
The Global Financial & Euro Crises highlighted the extent to which the Basel II capital framework had under-calibrated the Operational
Risk profiles of the G-SIBs. There are a number root causes of this issue:
 The design of AMA and TSA methodologies, i.e. their key drivers were Operational Risk losses and revenues respectively, which
meant that an economic shock that led simultaneously to an increase in Operational Risk losses and a decline in revenues was certain
to cause AMA and TSA capital requirements to move in opposite directions (slide 26).
 “Under-calibration” - The Basel Committee’s loss data collection exercises were undertaken during a relatively benign period for
Operational Risk losses, leading to the “under-calibration” of TSA. This had a knock-on impact on AMA models, as the Basel
Committee allowed AMA banks to have a discount to TSA of up to 25% (slide 27).
 Lack of comparability - The Basel Committee’s principles-based framework allowed for a significant degree of flexibility. This led to a
lack of comparability in the models, with quite disparate relationships between the losses suffered by individual banks during the
Global Financial & Euro Crises and their Pillar 1 Operational Risk capital requirements (slide 28).
 12 month time horizon - The various Basel capital accords focus on calculating Pillar 1 capital requirements for a 12 month time
horizon. The nature of large Operational Risk losses (≥$0.1bn) is that there can be significant lags between detection and settlement
(on average 3 to 4 years) allowing banks the opportunity to accrue for these losses over many years. Ignoring this feature of
Operational Risk may actually lead to the overstatement of capital requirements (slides 5, 29 & 30).
 Use of scenarios - Owing to the “paucity” of data for very large losses, scenarios are often used to plug gaps in the data. Unfortunately
humans are not very good at estimating the likelihood to remote risks, and additionally Operational Risk capital models can be very
sensitive to these inputs. Consequently small changes in the inputs for likely scenarios can have disproportionately large impacts at
99.9th percentile, leading to banks having to calibrate the model inputs, in order to achieve reasonable model outputs (slide 31) - the
Basel Committee noted that AMA capital was “often benchmarked against this under-calibrated [TSA] capital requirement.” 1
 Failures of Operational Risk Management - Finally, there was a failure of Operational Risk management to detect a number of on-
going events and also to prevent the occurrence of new material events at the outset of the Global Financial Crisis (slide 32).
The next section considers how these issues have or may be addressed, recognising that there is no perfect solution.
Source: 33
1. Basel Committee, (October 2014) “Consultative Document: Operational Risk – Revisions to the simpler approaches”.
5. SOLUTIONS & CONCLUSIONS
5. INTRODUCTION

Whilst some of the issues suffered by AMA models were due to the fundamental nature of Operational Risk (see section 1), others
arose from design failings (see section 4). This final section considers:

Pillar 1
 Operational Risk capital and losses – after the financial crises.
 New Standardised Approach – overview & assessment.

Pillars 1 & 2
 The PRA’s three loss estimation approaches.
 Revisiting the purpose of operational risk capital.

Pillars 1 & 2 and Loss Absorbing Buffers

 An ‘hourglass’ – tailored approaches for calculating Operational Risk capital.

Conclusions.

34
5. PILLAR 1
- CAPITAL & LOSSES IN 2016 - AFTER THE FINANCIAL CRISES
The consequence of the spike in Operational Risk losses associated with the Global Financial & Euro Crises was that the Operational Risk
capital requirements, for a sample of nine AMA banks, significantly increased, in aggregate by 64%, and the proportion of Operational
Risk RWAs to total RWAs rose to 20%, which was the figure originally proposed by the Basel Committee (slide 27). This suggests that
Operational Risk capital models may not be so fundamentally flawed, although this outcome may also have been reverse engineered
(slide 31).
Analysis of losses and RWAs for nine AMA banks 2008 to 2016

Losses for 2008 to 2016: RWAs in 2016:

 Impairments (Dark blue)  Credit Risk (Dark blue)
 P&L charges for litigation &  Operational Risk (White)
regulatory settlements (White)  Market Risk (Light blue)
 Losses suffered from trading (Light
blue)

35
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
5. PILLAR 1
- NEW STANDARDISED APPROACH - OVERVIEW
In 2017 the Basel Committee finalised its approaches for replacing AMA, TSA, and BIA for calculating Pillar 1 Operational Risk capital
requirements, with the New Standardised Approach. It is intended to deliver more consistency and stability, but with the potential
for some degree of risk sensitivity, and it also reflects lags in settlement, via the Internal Loss Multiplier.
Business Indicator Component Internal Loss Multiplier
0.8
Average annual net losses1
Business Indicator over 10 years X 15
Business Indicator X X Ln Exp (1) – 1 +
Marginal Coefficients Business Indicator
Component

Business Indicator is derived from the average revenues of banks over the preceding three years. It is comprised of three components:
interest income and dividends; net trading and bank book income; and other operating and fee income. The methodology for
calculating these three components has been modified to remove some of the spurious behaviours of Basel II’s TSA, i.e. trading P&L is
an absolute number, so that if the investment banking arm of a universal makes a large trading loss then the Group will in future not
benefit from a negative Operational Risk capital requirement for this loss making business. The Business Indicator would still decline,
however, during a period of economic stress, if interest rates are cut, squeezing margins, and / or customer activity declines.
Business Indicator Marginal Coefficients (α) vary depending upon size of a bank, i.e.: 12% for the Business Indicator values of ≤€1bn;
and 15% for Business Indicator values of €1bn to €30bn; and 18% for Business Indicator values of >€30bn (see Appendix V).
Internal Loss Multiplier (ILM) is calculated as a log function, allowing the Business Indicator Component to be either scaled up or
down for the historical loss experiences of banks (for losses >€20k) over the preceding 10 years.1 This goes towards addressing the
challenges of the “paucity” of loss data, and also the timing of losses (slide 29), although there is no methodology for differentiating
losses arising from economic slowdowns vs idiosyncratic losses. Local supervisors have discretion, however, to set the ILM to “1”,
removing this “risk sensitive” element of the New Standardised Approach, i.e. the UK and EU are expected to exclude the ILM.
Sources & footnotes: 36
[Link]’s analysis suggests that the mean ratio for ILM between 2002 and 2022 would range between 1.03x to 1.28x. (ORX, (2023) “Basel III and Standardised Approaches to capital”.)
5. PILLAR 1
- NEW STANDARDISED APPROACH – ASSESSMENT
Section 4 set out the root causes for the issues that AMA models experienced during the Global Financial & Euro Crises. It is important
to assess whether the New Standardised Approach, including ILM, would have fared any better had it launch on 1 st January 2008.
1st January 2008 vs 1st January 2023
The New Standardised Approach would still have underestimated the capital required for the surge in losses from 2008 onwards,
because the ILM is backward looking, and losses in the 10 years before 2008 are an order of magnitude smaller than for those for the
following 10 years (slide 18). The scale of the under-calibration (slide 19) for large & sophisticated banks would, however, have been
less significant, due to the absence of the 25% discount to TSA that AMA firms could receive, and the setting of the α to 18%.
As the Global Financial Crisis proceeded the two components of the New Standardised Approach would move in opposite directions:
 The Business Indicator would have initially declined, due to reduced trading revenues (although the distortion of losses has been
removed), reduced interest income, as margins were squeezed by zero or negative rates, and declining customer activity; but
 Internal Loss Multiplier would have initially been stable, before increasing, as Operational Risk losses mounted.
This actually reflects what happened, i.e. “…the frequency of losses [EDPM and External Fraud] in the early-crisis period [H2 2006 to H2
2007] was similar or slightly lower than pre-crisis losses” before increasing to “above pre-crisis levels”.1 In conclusion, the New
Standardised Approach would have fared better than AMA in the Global Financial Crisis, primarily because it is more appropriately
calibrated, reflecting the old adage that Generals prepare for the next war, by planning to fight the last war again!
Looking forwards
In the short-term the:
 Internal Loss Multiplier will decline as losses from the Global Financial & Euro Crises simply drop out of the ILM calculations; and
 Business Indicator will increase as rising rates allow banks to widen their margins.
In the medium-term, the Operational Risk profiles of banks may increasingly be influenced by:
 The digital revolution, including cyber-criminals that have first harnessed the power of AI, and then quantum computing; and
 Climate Change which may influence the occurrence and severity of losses, and their correlations (see Appendix VI).
The New Standardised Approach is fundamentally backward looking, and so is incapable of reflecting that the Operational Risk
profiles of banks are changing due to these emerging threats, and hence these need to be reflected in Pillar 2 capital. 37
Source: 1. Cope, E. and Carrivick, L., (2013) “Effects of the Financial Crisis on Banking Operational Risk Losses”, Journal of Operational Risk, Vol. 8, No. 3.
5. PILLARS 1 & 2
- THE PRA’s THREE LOSS ESTIMATION APPROACHES
In some jurisdictions, Operational Risk capital models will still be used, following the implementation of Basel III to calculate:
 Risks not adequately captured by the New Standardised Approach for Pillar 1;1 and
 Factors external to the bank, e.g. business cycle effects.
The PRA has observed that “Sizing capital for Operational Risk is a significant challenge”, and it has published three approaches for
estimating Pillar 2 Operational Risk capital,2 excluding Conduct Risk (aka CPBP)3. These three approaches can also be utilised by firms
to back-test the outputs of their Operational Risk capital models:
1. Extrapolation of forecast losses to 1 in 1,000 years. A review of the ratio of low value ORX losses (€20k to €100k) to higher value
ORX losses (≥€10m) suggests that the multiplier is up to 16x. 4
2. Extrapolation of the average of the five largest losses (reported in COREP 17) for each of the last five years for each Basel event
type out to 1 in 1,000 years using a Pareto distribution. A review of the ratio of annual P&L charges for litigation & regulatory
settlements to Pillar 1 capital for AMA banks suggests that these approximate to the total value of losses in any one year multiplied
by between 1½ and 7 (slide 28), with an average of ~4. 5
3. Extrapolation of a firm’s five largest scenarios out to 1 in 1,000 years, using a fat-tailed distribution [presumably Pareto again], and
a pre-defined diversification benefit. The PRA has not published the diversification benefit that they intend to use, however,
anecdotally around 30% to 40% is reasonable.
Ultimately, “supervisory judgement” is applied to determine a bank’s Pillar 2A capital for non-Conduct Risks based upon: the
quality of the firm’s Pillar 2A assessment; the outputs of these three loss estimation approaches; the quality of the firms scenario
analysis, loss data, Operational Risk management & measurement frameworks;6 and finally peer comparison.
Sources & footnotes:
1. Pillar 2A ≈ Output from an Operational Risk capital model at 99.9 th percentile minus Pillar 1 capital requirements.
2. PRA, (July 2021) “Statement of Policy The PRA’s methodologies for setting Pillar 2 capital”.
3. CPBP reflects the PRA’s knowledge & judgement of a bank’s exposures to conduct risk, the largest losses over the previous five years, expected losses, and scenario analysis.
4. The ratio of low value losses (€20k to €100k), which may approximate to “expected losses” to high value losses (≥€10m), which may approximate to “unexpected losses” varies over a
two decade period (1998 to 2018) between 4x and 16x.
5. Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons. 38
6. Whilst there is no regulatory specification for these Pillar 2 models, the PRA references that they need to be “of AMA standard”, although practices are now beginning to diverge.
5. PILLARS 1 & 2
- REVISITING THE PURPOSE OF OPERATIONAL RISK CAPITAL
Operational Risk capital is different from Market & Credit Risk capital:
 Operational Risk is relatively insensitive to incremental business. Every new trade, credit card issued, or loan made etc marginally
increases a bank’s risk profile, and this is reflected in its Market & Credit Risk RWAs. This is not the case for Operational Risk. Whilst
every incremental trade, credit card, or loan etc may marginally increase a bank’s expected losses, the “paucity” of very large losses
and its “unusually fat-tailed” distribution means that the Operational Risk capital requirements produced by a model simply do not
change with each new trade, credit card, or loan etc.1
 Banks cannot readily act to reduce their Operational Risk RWAs in the same way that they can for Market & Credit Risk. I
remember working at a bank, many years ago, where I spent the 4 th quarter working on divesting loans to reduce Credit RWAs in
order to ensure that the bank’s capital ratios were maintained. There was no comparable Operational Risk RWA reduction activity.2
 Banks cannot utilise their Operational Risk capital. If a bank suffered a very significant Operational Risk loss that drove it into loss,
unless it had sufficient surplus capital, it would need to either reduce Market & Credit Risk RWAs or raise new capital. 3

As a consequence of the above, Operational Risk capital has been referred to as “dead capital” because it is only of use to protect
depositors in a “gone concern” situation, and has no loss absorbency in a “going concern” situation.

The next slide sets out my approach for capital modelling that I first proposed in 2018, that reflects Operational Risk’s nature and its very
significant sensitivities to economic shocks (slide 7), and proposes a much more equal split of total Operational Risk capital requirements
between Minimum Capital Requirements and Loss Absorbing Buffers, that can be utilised in times of economic stress.

Sources & footnotes:

[Link] accounting attempts to address this issue (Butler, T., & Brooks, R. (2023). ”Time for a paradigm change: Problems with the financial industry's approach to operational risk”. Risk
Analysis.)
[Link] 2016 Credit Suisse took out a five year Operational Risk insurance policy with Zurich Insurance. The policy provided CHF300m of cover, but the retention value was high, i.e.
CHF3.5bn. Zurich Insurance obtained re-insurance from a Bermudan SPV, which financed the re-insurance through the issuance of catastrophe bonds. This policy reportedly led to a
CHF150m or 2.8% reduction in the Bank’s Operational Risk capital requirement. Only a very few banks would have the necessary sophistication to execute such a transaction. 39
[Link], P., Liao, G., and Ma, Y., (2016) “Rethinking Operational Risk Capital Requirements” , Harvard Business School, Working Paper 2016-06.
5. PILLARS 1 & 2 AND LOSS ABSORBING BUFFERS
AN ‘HOURGLASS’ - TAILORED CAPITAL APROACHES
If the different capital Pillars genuinely reflected how Operational Risk actually behaves, then I think that it would look more like an
‘hourglass’, which I’ve annotated with suggestions as to how each Pillar should be calculated, in order to avoid double counting.
• Stress testing to capture risks sensitive to economic cycles using Scenario

used during stress

Loss Absorbing Buffers

Capital that can be

Analysis and Operational Risk capital models e.g.:
− Compensation and regulatory fines (CPBP) underpinned by credit losses,
e.g. MBS litigation (slide 7); or Factors external to banks
− Compensation and regulatory fines (CPBP) underpinned by directional
moves in markets (slide 7).
• Capital requirements need to reflect the cumulative impacts of an economic ~40%
shock across all risk categories, through the cycle (slides 8, 17 & 30).

Scenario Analysis and models to reflect:

Pillar 2A
• Emerging threats and new risks, e.g. the nexus of cyber-crime, digitisation, and AI.

Capital that must be preserved

• Risks missing from a firm’s internal loss data, e.g. arising from new businesses. Risks not adequately
• Any remaining anomalies in the New Standardised Approach, e.g. legacy litigation captured under Pillar 1
arising from a terminated business.

Sudden losses and also those insensitive to economic cycles: Pillar 1

Use the New Standardised Approach; but
• Exclude CPBP sensitive to economic cycles from the Internal Loss Multiplier Minimum capital requirements
that settle >12 months, and include instead in the Loss Absorbing Buffers.
• Include CPBP insensitive to economic cycles in the Internal Loss Multiplier, as ~60%
a series of annual P&L charges for litigation & regulatory settlements,
reflecting slides 5, 29 & 30. (slide 30)
40
Source:This diagram is adapted from Grimwade, M., (2018) “An alternative to SMA: Using through the cycle loss data to propose an ‘hourglass’ solution”, JRMFI, Vol 11, No 4.
CONCLUSIONS - “…DEMOCRACY IS THE WORST FORM OF
GOVERNMENT, EXCEPT FOR ALL OF THOSE OTHERS…TRIED…” 1
Lessons learnt from the last three decades
 Operational Risk is “…too important not to be treated separately within the capital framework.”
 But modelling Operational Risk is inherently challenging because its “…loss distribution is unusually fat-tailed, with infrequent but very
large losses, [for which]…there is a paucity of data.”.
 Using scenario analysis to address the paucity of data for large losses is problematic, due to the limitations of human estimations of
the likelihoods of remote risks and / or the potential for gaming, and the extreme sensitivity of the models to these inputs (slide 31).
 Spikes in losses have coincided with economic shocks – leading to the potential for double counting between Pillars 1 & 2, but the
lags in losses crystallising reduces the likelihood of Market, Credit and Operational Risk losses all coinciding (slide 8).
Solutions
 The New Standardised Approach provides a level playing field for Pillar 1, and the Internal Loss Multiplier both allows for some risk
sensitivity and also reflects the extended lags for CPBP, although these are lost if the ILM is set to “1”. If it had been launched on 1st
January 2008, it too would have performed badly in the face the Global Financial Crisis, but maybe not as badly as AMA.
 Operational Risk models are still useful for modelling emerging risks and stress testing, but owing to the nature of Operational Risk
they are often more precise than they are accurate (slide 14). Ultimately the outputs from the model must be reasonable, and must
reflect any changes in a bank’s business & risk profiles. As a result, banks often need to adjust their scenario inputs, within acceptable
ranges, in order to obtain meaningful outputs (slide 31), which regulators can assess via loss estimation approaches etc (slide 38).
 Expanding Loss Absorbing Buffers, at the expense of Pillar 1, to reflect the sensitivity of Operational Risk to economic shocks (slide
7), would enable banks to utilise some of their Operational Risk capital in times of economic stress (slide 40).
Whilst the nature of Operational Risk means that there will never be a perfect solution to estimating capital, emerging threats
associated with the digital revolution and Climate Change will only increase the need for forward looking models.
41
Source: 1. Winston Churchill, in November 1947.
THE FOUNDATION OF MY BOOK - “TEN LAWS OF
OPERATIONAL RISK” - IS UNDERSTANDING ITS BEHAVIOURS
“This book is different from all other operational risk books in the market.”
“The Author leverages his extensive experience to bring order to this challenging risk.”
“…one of the most interesting risk reads of the last 20 years.”
“…a turning point in the field of Operational Risk”
"A book replete with important insights...”
“Explodes myths around Operational Risk”
“It will make you think differently about Operational Risk.”
“Unique & compelling.”
“…genuinely thought-provoking.”
“Assertions are evidence based…”
“It’s like watching a skilled artisan transform a shapeless lump of clay into a beautiful pot”
"Un imprescindible para los gestores de riesgos.“
“Excellent ouvrage!”
“Lesenswert” - [worth reading]
"The Richard Dawkins of Operational Risk - another excellent contribution."
Pictures from readers in Abu Dhabi, Albania, Australia, Bangladesh, Brazil, Chile, Columbia, Denmark, the Dominican Republic, Germany, India, Italy,
42
Japan, Malaysia, Norway, Peru, Qatar, Saudi Arabia, Singapore, South Africa, Spain, Switzerland, Thailand, the UK, Ukraine, the US, and Vietnam.
YOU MAY ALSO WANT TO LOOK-UP MY PREVIOUS
RECORDINGS & SLIDES…
Previous presentations on Operational Risk management are available on LinkedIn via the hashtag #tenlawsofoprisk or my “posts”
for recorded presentations and “documents” for the slides:
Ten Laws of Operational Risk Practical risk management
1. A better bow-tie diagram? 11. Rogue trading: Techniques, Red Flags and Quantification.
13. Reputational Risk: Drivers, financial consequences & quantification.
2. Is Operational Risk really random?
24. Operational Risks arising from IT change.
3. The nature of inadequacies or failures. 25. Operational Risks from risk transfer via new products.
4. How does business profile influence Operational Risk? 26. Tailoring RCSAs for Operational Risk’s behaviours.
5. Are causal factors correlated? 27. Predictive KRIS & KCIS - Op Risk’s Holy Grail?
6. Hares or tortoises: which losses are most expensive? 28. Using insurance to transfer Operational Risk.
30. Root cause analysis: “…tough on the causes of Op Risk”.
7. The importance of time: duration & lags.
32. The potential impacts of digitization & AI on Operational Risk.
8. How should an Operational Risk profile be represented? 37. Articulating Operational Risk appetite.
9. How & why is Operational Risk sensitive to economic shocks.
Stress testing & scenario analysis
10. Transforming Credit & Market Risks into Op Risk. 16. Systematic Estimation of the likelihood of remote events.
12. Do firms proactively take Op Risks to generate revenues? 17. Systematic Estimation of the severity of remote events.
14. Op Risk: Understanding its behaviours, to improve its management. 18. Validation techniques for scenario analysis.
15. & 29. How the current economic conditions may drive Op Risk losses.
Climate Change 31. Bank failures & rescues: “Where there’s a loss, there’s a lawsuit”.
19. Behavioural changes & economic consequences. 38. Approaches to stress testing Operational Risk.
20. Transmission to Operational & Reputational Risks. Emerging Operational Risk threats
21. Quantification of Operational Risks. 22. Emerging Op Risks: Looking back at 2022 and to 2023 & beyond.
23. Quantification of the financial consequences of reputational damage. 36. Emerging Op Risks: Looking back at 2023 and to 2024 & beyond.
33. How Climate Change may impact Operational & Reputational Risks. 39. Emerging Op Risks: Looking back at 2024 and to 2025 & beyond.
34. AI’s impacts on Operational Risk scenarios. 43
APPENDICES
APPENDIX I: THE LIST OF 12 BANKS USED IN THIS ANALYSIS

AMA banks
1. JP Morgan Chase
2. SocGen
3. Credit Agricole
4. Unicredit
5. UBS
6. Credit Suisse
7. Deutsche Bank
8. Barclays
9. BNP Paribas

Switched from AMA to TSA in 2010

10. Lloyds TSB / Lloyds Banking Group

TSA banks
11. HSBC
12. RBS
44
APPENDIX II: BASEL II’s STANDARDISED AND BASIC
INDICATOR APPROACHES
The Standardised Approach (TSA), that was introduced by Basel II, makes two key assumptions about Operational Risk:

1. Gross income is used as “a proxy for the scale of business operations and thus the likely scale of operational risk exposure” 1
2. Different business lines expose firms to variable amounts of Operational Risk:
− Corporate Finance, Trading & Sales, and Payments & Settlements were perceived to be the riskiest activities;
− Commercial Banking and Agency Services were perceived to less risky; whilst
− Retail Banking, Asset Management, and Retail Brokerage were perceived to be the least risky.

Operational Risk capital is calculated by multiplying average gross revenues over three years by one of three s: 18%, 15% and 12%,
which were applied to the revenues of each of the 8 business lines listed above, e.g. the riskiest business lines attracted the 18% ,
whilst the least risky attracted only the 12% .

The Global Financial & Euro Crises clearly highlighted the deficiencies in this approach, i.e.:

 The s were “under-calibrated”, e.g. some of the largest losses suffered by banks around this time related to Retail Banking, such
as the mis-sale of PPI in the UK, and the inappropriate foreclosure scandal in the US.

 The generation of negative revenues by the Trading & Sales businesses of some banks, at the outset of the Global Financial Crisis,
suppressed the capital requirements of these firms over the following three years.2

The Basic Indicator Approach (BIA), also uses average gross revenues over three years, as “a proxy for the scale of business
operations” but the multiplier used (α) has a single value of 15%.
Sources & footnotes:
1. Basel Committee, (June 20104) “International Convergence of Capital Measurement and Capital Standards”.
2. As noted on slide 36 this has been addressed by the New Standardised Approach by making trading revenues an absolute number, although, anecdotally, regulators were 45
aware of this issue, during the Global Financial Crisis, and compensated for it via Pillar 2A capital.
APPENDIX III: COVERAGE OF OPERATIONAL RISKS BY
INSURANCE
The Basel Committee collected data on losses and recoveries from 30 banks for 1998 to 2000 (QIS-2). Whilst the number of events with
insurance recoveries in this two decade old data is low, this may reflect its fat-tailed nature, i.e. losses ≥€1m represented just 2.3% of the
total number of loss events ≥€10k, but 73% of the total value of these losses. Successful claims had high recovery rates.
At the discretion of their regulators, banks may be able to reduce their Pillar 2A Operational Risk capital requirements to reflect the
benefits of their insurance policies, if they meet the criteria set-out in Basel II for insurance deductions from Pillar 1 capital requirements.

46
APPENDIX IV: BACK-TESTING – MODEL OUTPUTS
- IMPLIED REMOTE VALUES VS KEY BUSINESS METRICS
If model outputs are derived from scenario analysis inputs, then they can be compared to key business metrics to assess their
reasonableness, and the inputs adjusted, whilst staying within an acceptable range, in order to obtain meaningful outputs.

Comparison of model outputs derived from scenarios inputs vs key business metrics
Likelihood

Scenario:
1 in 25 years
Reasonableness check against model
outputs using key business metrics e.g.:
 Largest payments; or
Scenario:  Largest underwrites; or
1 in 50 years
 Largest fat-finger limits; or
 Largest losses & near misses, etc.
Model output:
1 in 1,000 years

Impact
47
Source: Adapted from “Ten Laws of Operational Risk”, by M. Grimwade, Wiley & Sons (December 2021).
APPENDIX V: THE RELATIONSHIP BETWEEN SIZE AND
OPERATIONAL RISK LOSSES
Average losses ≥$0.1bn over ten years vs average recent revenues for 30 G-SIBs
The assumption of a relationship
between the scale of revenues and
Operational Risk losses seems
questionable. This chart analyses:
 The annual average value of large
losses (≥$0.1bn) for two, ten year
periods (i.e. 1998 to 2007 and 2008
Three
to 2017) before, and during and after
US banks
the Global Financial Crisis; and
 Average revenues (2015 and 2016)
for 30 current & former G-SIBs.

The trend-line for 1998 to 2007 is almost

flat, showing little relationship between
losses and revenues, whilst the trend-
line for 2008 to 2017 does rise with
revenues, but only as a result of the
losses suffered by the three largest US
banks, which are quite disproportionate
in comparison to the largest Asian
banks.
48
Source: Grimwade, M., (December 2021) “Ten Laws of Operational Risk”, Wiley & Sons.
APPENDIX VI: OPERATIONAL RISK CAPITAL MODEL
– OVERLAYING CLIMATE CHANGE
Climate Change may influence all of the inputs into a capital model, and the different Pillars over different time horizons, depending on
the Climate Change scenario, e.g. the Late Action scenario occurs between 2030 & 2035 and will be a transient economic shock (Pillar 2B);
whilst the No Additional Action scenario leads to persistent economic & environmental instability, requiring additional Pillar 2A capital.

Overlaying Climate Change onto an Operational Risk capital model

Pillar 2B (model)
Pillar 2A (model)
49
Source: Grimwade, M. (June 2022), “How Climate Change may impact Operational Risk”, Journal of Operational Risk, Vol. 17, No. 2.