13.0 OBJECTIVES This chapter would help in understanding © Operational Risk * Classification of Operational Risks © Management of Operational Risks ¢ Measurement Approaches to Operational Risks © Integrated Risk Issues in Integrated Risk Management 13.1 OPERATIONAL RISK - GENERAL Operational risk is one area of risk that is faced by all organisations. The more complex an organisation iS the more would be its exposure to operational risk. Operational risk would arise due to devistins from normal and planned functioning of systems, procedures, technology and human failures nr comission and commission, Results of deviation from normal functioning are reflected in the revenace of the organisation, either by way of additional expenses or by way of loss of opportunities the would bs otherwise feasible. Operational risk may also arise due to inherent faults in systems. procedures ond technology of an organisation, which may also impact its revenues adversely. The Basel Conmimes has defined “Operational Risk’ as follows: “The risk of loss resulting from inadequate or failed intemal processexf and system’) or from Criticality of operational risk has been recogni accounting for operational risk. The criticali viewed in the context of changes that have and Europe and since late nineties in India, Driven by deregulation and the need to bi technological advances, Jarge volume of customers on several platforms, ized in Basel Il, which requires specific capital allocation ity of operational risk in the functioning of banks has to be taken place in the banking industry. Since eighties in USA Wwe have witnessed sea changes in the functioning of banks. ecome globally competitive, banks have made tremendous have brought ina plethora of new financial produets, and are catering to avery The time tested systems and procedures in traditional banking were developed over several decades. In the process of perfecting the systems and procedures, banks might have faced operational losses but as the changes were only few and far between, systems got time to stabilize. In the resent context of fast changing environment and work practices, the time required to stabilize systems and procedures is not enough. So, as banks respond to the needs of competition, systems and procedures and human adaptation of the changes create operational risks inherent in the banking business, Accordingly, this risk needs to be factored into and taken into account in the banking business. Therefore, proper management of operational risks is an imperative, If operational risks are managed ‘well the rewards are available by way of lesser risk cop fos Feductions in operations Both these ‘advantages may have a considerable impict on the competitive edge of banks. The basic motivation for ‘management of operational risk stems from it._Béiuse-based i ye People oriented causes — negligence, incompetence, insufficient training, integrity, key man. Process oriented (Transaction based) causes — business volume fluctuation, organizational complexity, product complexity, and major changes. Process oriented (Operational control based) causes — inadequate segregation of duties, lack of management supervision, inadequate procedures. Technology oriented causes — poor technology and telecom, obsolete applications, lack of automation, information system complexity, poor design, development and testing. External causes —natural disasters, operational failures of a third party, deteriorated social or political context. Abect Based Legal liability Regulatory, compliance and taxation penalties Loss or damage to assets Restitution Loss of recourse Write-downs However, the Third Consultative Paper recommended event based classification. They are listed below.oat Based Internal Fraud 2. External Fraud Employment practices and workplace safety Clients, products and business practices Damage to physical assets Business disruption and system failures mos Execution, delivery and process management 13.3 OPERATIONAL RISK CLASSIFICATION BY EVENT TYPE — DEFINITIONS ee Fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent Fegulations, the law or company policy, excluding diversity/discrimination events, which involve at least ‘one internal party. ternal Fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party. _-Priplosment Practices and Work Place Safety: Losses arising from acts inconsistent with employment, health or safety laws or agreements from payment of personal injury claims, or from diversity/ discrimination events. élients, Products and Business Practices: Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. L-Bamage to Physical Assets: Losses arising from loss or damage to physical assets from natural disasters or other events, J Miisiness Disruption and System Failures: Losses arising from disruption of busines or system failures Execution, Delivery and Process Management: Losses from failed transaction processing or process management, from relations with trade counterparties and vendors.13.8 OPERATIONAL RISK QUANTIFICATION This is by far the most difficult of all risk measurements. The behaviour pattern of operational risk does not follow the statistically normal distribution pattern and that makes it difficult to estimate the probability of an event resulting in losses. The historical loss distribution pattern, which may provide a method to estimate operating losses requires a data set that has statistically acceptable numbers of loss. Related data may be captured only over a period. Basel II has recognised the difficulties in measurement of operational losses. Consequently, it has provided options in the measurement of operational risk for the purpose of capital allocation purposes. They are: 1. The Basic Indicator Approach (BIA) 2. The Standardised Approach (TSA) 3. Advanced Measurement Approaches (AM Of these, the Basic Indicator and the Standardised Approaches are bas enerated. The Advance Measurement Approach is based on operational loss measurement. A brief description of the Basel II prescriptions under these approaches is given below. For details, it is advised that Basel II document may be consulted. The Basic Indicator Approach Banks using the Basic Indicator Approach must hold capital for operational risk equal to the average over the previous three years of fixed percentage (15%) pf positive annual gross income. Figures for BIA = Avessye of ys Libngthe ora Rc fen exelodd]., ¢ excluded from both the numerator any year in which annual gross income is negative or zero should b i and denominator when calculating the average. ‘ st income. It is intended that thi. Gross income is defined as net interest income plus Seca foes of opeiating caper measure should: (i) be gross of any provisions (c.g. for unpaid interest), lised profits/losses from the sajg_ including fees paid to outsourcing service providers; (iii) Sle cinaits items as well as income. of securities in the banking book; and (iv) exclude extraordinary 4 derived from insurance, tandardised Approach — In the Standardised Approach, banks’ activities are divided into eight business lines: ¢ See eee Corporate finance, trading and sales, retail banking, commercial banking, payment and settlement, agency ‘ervices, asset management, and retail brokerage. Within each business line, gross income is a broad indicator that serves as a proxy for the scale of business perations and thus the likely scale of operational risk exposure within each of these business lines, The capital charge for each business line is calculated by multiplying gross income by a factor (denoted beta) assigned to that business line (Beta Factors). Sie Lines Beta Factors —Corporate finance — 18% — Trading and sales — 18% —Retail banking ~ 12% — Commercial banking — 15% —Payment and settlement — 18% ~ Agency services — 15% ~ Asset management — 12% — Retail brokerage — 12%Estimated level of operational risk depends on2- timated probability of occurrence — ‘imated potential financial im Estimated impact of internal controls Estimated Probability of Occurrence This will be based on historical frequency of occurrence and estimated likelihood of future occurrence. Probability is mapped on a scale of S say where 1. implies negligible risk 2. implies low risk 3. implies medium risk 4. implies high risk 5. implies very high risk Estimated Potential Financial Impact This will be based on severity of historical impact and estimated severity of impact from unforeseen events. Probability is mapped on a scale of 5 as mentioned above. Estimated Impact of Internal Controls This will be based on historical effectiveness of internal controls and estimated impact of internal controls on risks. This is estimated as fraction in relation to total control, which is valued at 100%. Estimated level of operational risk =(Estimated probability of occurrence x Estimated potential financial impact x Estimated impact of internal controls ] Ye 7 case of a hypothetical example where Probability of occurrence = 2 (Medium) Potential financial impact = 4 (very high) Impact of internal controls = 50% Estimated level of operational risk = [(2 x 4 * (1 ~ 0.50] 4 0.5 = 2.00 or ‘Low*