FINANCIAL RISK ANALYTICS AND MANAGEMENT
OPERATIONAL RISK
FIN F 414
ACV SUBRAHMANYAM
[Link]@[Link]
OPERATIONAL RISK DEFINITION
Liabilities
Operational risk is the risk
• Capital and Reserves of loss resulting from
• Borrowings
• Deposits inadequate or failed
• Provisions & Other Liabilities internal processes,
Assets people, and systems, or
• Cash
from external events
• Investments
• Loans & Advances
• Fixed Assets Basel Committee Jan 2001
Contingent Liabilities
TOP 10 OPERATIONAL RISKS FOR 2025
1. Cybersecurity threats: This is consistently ranked as the top risk, driven by ransomware, data breaches, and cyberattacks on critical
infrastructure.
2. Economic volatility: Includes inflation, market fluctuations, and overall economic uncertainty.
3. Regulatory compliance and uncertainty: Keeping up with new and changing regulations across different jurisdictions is a major challenge.
4. Supply chain risk: Disruptions due to geopolitical events, natural disasters, or other factors can severely impact operations.
5. Workforce challenges: A growing risk includes talent and labor shortages, as well as the need to upskill employees for new technologies like AI.
6. Third-party risk: Relying on vendors and partners creates a risk if their own security, resilience, or compliance measures are weak.
7. Geopolitical risk: Political instability, trade disputes, and conflict can disrupt international operations and markets.
8. Digital and IT disruption: This encompasses risks from IT system outages, a reliance on centralized tech ecosystems, and the general pace of
digital change.
9. Operational resilience: The ability of an organization to withstand and recover from major disruptions, including IT outages, is a key
operational risk.
10. Data management and privacy: Risks associated with the management, security, and privacy of vast amounts of data continue to be a major
concern.
Source: Internet - RISKs
WHAT IT INCLUDES
The definition includes people risks, technology
and processing risks, physical risks, legal risks, etc
The definition excludes reputation risk and
strategic risk
OPERATIONAL
RISK
CHAPTER 20
JOHN C HULL
[Link]
BUSINESS LINES
Corporate finance
Trading and sales
Retail banking
Commercial banking
Payment and settlement
Agency services
Asset management
Retail brokerage
POSSIBILITIES OF
OPERATIONAL RISK
Combining the
seven categories
of risk with the
eight business
lines gives a total
of 7 × 8 = 56
potential sources
of operational
risk for a bank.
REGULATORY CAPITAL – OPERATIONAL RISK
COMPUTATIONS OF OPERATIONAL
APPROACHES TO MEASURE OPERATIONAL RISK
⚫ In Basel II there is a capital charge for Operational Risk
⚫ Three alternatives:
⚫ Basic Indicator (15% of annual gross income)
⚫ Standardized (different percentage for each business line)
⚫ Advanced Measurement Approach (AMA)
BASIC INDICATOR (15% OF ANNUAL GROSS INCOME)
BASIC INDICATOR (15% OF ANNUAL GROSS INCOME)
Numerical Example
We consider Bank A, whose
activity is mainly driven by retail
banking and asset management. We
compare it with Bank B, which is
more focused on corporate
finance.
We assume that the two banks are
only composed of four business
lines: corporate finance, retail
banking, agency services and asset
management.
The gross income expressed in $
mn for the last three years is given
below:
THE
STANDARDIZED
APPROACH
THE
STANDARDIZED
APPROACH
THE STANDARDIZED APPROACH
• In the case of the standardized approach, the beta coefficients are respectively equal to 18%, 12%, 15% and 12%.
LOSS SEVERITY VS LOSS FREQUENCY
Loss frequency should be estimated from the banks own data as far as possible. One
possibility is to assume a Poisson distribution so that we need only estimate an average
loss frequency. Probability of n events in time T is then
Loss severity can be based on internal and external historical data. (One possibility is
to assume a lognormal distribution so that we need only estimate the mean and SD of
losses)
SAMPLE FROM FREQUENCY
DISTRIBUTION TO DETERMINE
THE NUMBER OF LOSS EVENTS
(=N)
SAMPLE “N” TIMES FROM THE
LOSS SEVERITY DISTRIBUTION
TO DETERMINE THE LOSS
SEVERITY FOR EACH LOSS
EVENT
SUM LOSS SEVERITIES TO
DETERMINE TOTAL LOSS
ADVANCED MANAGEMENT APPROACH
Four elements specified by Basel committee:
Internal data
External data
Scenario analysis
Business environment and internal control factors
ADVANCED MANAGEMENT APPROACH - INTERNAL DATA
Operational risk losses have not been recorded as well as credit risk losses
Important losses are low-frequency high severity-losses
Loss frequency should be estimated from internal data
EXTERNAL HISTORICAL LOSS SEVERITY DATA
Two possibilities
data sharing
data vendors
Data from vendors is based on publicly available information and therefore
is biased towards large losses
Data from vendors can therefore only be used to estimate the relative
size of the mean losses and SD of losses for different risk categories
SEVERITY
BY
EVENT TYPE
SEVERITY
BY
BUSINESS LINE
EXAMPLES
EXAMPLES
EXAMPLES
EXAMPLES
REFERENCES
RISK MANAGEMENT IN
FINANCIAL INSTITUITIONS
– JOHN C HULL
OPERATIONAL RISK
MANAGEMENT IMAD A
MOOSA