A Regulatory Perspective on

Operational Risk
World Bank Presentation
May 20, 2004
Presented by:
Eric Rosengren
Senior Vice President
Federal Reserve Bank of Boston

Outline
How to define operational risk for banks
Why banks and supervisors are pursuing
quantification of operational risk
A detailed look at the Advanced
Measurement Approach for banks
Implications for emerging markets

Basle Operational Risk Definition/

Framework
The risk of loss resulting from inadequate
or failed internal processes, people and
systems or from external events

This definition includes legal risk

Strategic and reputational risk are excluded

Basle Operational Risk Definition/

Framework continued...
Operational Risk is not:

All risk other than credit and market

Only systems & IT related
New
Loss Event Types

Internal Fraud External Fraud

Employment
Practices &
Workplace
Safety

Clients,
Products &
Business
Practices

Damage to
Physical Assets

Corporate Finance

Business Lines

Trading & Sales

Retail Banking
Payment & Settlement
Agency Services
Commercial Banking
Asset Management
Retail Brokerage

Business
Disruption &
System Failures

Execution,
Delivery &
Process
Management

Examples of Operational Loss Events

in Banking
Internal Fraud: Allied Irish Bank, Barings,
and Daiwa Bank Ltd - $691 million, $1
billion, and $1.4 billion, respectively fraudulent trading.
External Fraud: Republic New York Corp. $611 million - fraud committed by custodial
client.

Examples of Operational Loss Events

in Banking continued...
Employment Practices and Workplace
Safety: Merrill Lynch - $250 million - legal
settlement regarding gender discrimination.
Clients, Products & Business Practices:
Household International - $484 millionimproper lending practices; Providian
Financial Corp. - $405 million- improper sales
and billing practices.
6

Examples of Operational Loss Events

Damage to Physical Assets: Bank of New
York - $140 million - damage to facilities
related to September 11, 2001.
Business Disruption and System Failures:
Solomon Brothers - $303 million - change
in computer technology resulted in
unreconciled balances.

Examples of Operational Loss Events

continued...

Execution, Delivery & Process Management:

Bank of America and Wells Fargo Bank - $
225 million and $150 million, respectively systems integration failures/failed transaction
processing.

Banks Recognize the Significance of

Operational Risk
More than 100 losses exceeding $100 Million
over the last decade
Large banks recognize the importance/
magnitude of op risk:

Based on recent Basle survey, on average they

hold 15% of their capital for Op Risk.
Per their Annual Reports, Deutsche Bank and JPM
are holding 2.5B and $5.8B for operational risk.

Rationale Banks Cite for Quantifying

OpRisk
Operational failures negatively impact profitability

Banks that measure and manage operational risk can reduce

earnings volatility
Banks that measure and manage operational risk can reduce
likelihood of an operational event becoming a capital event

Businesses are more complex, changing rapidly,

operationally intensive, and technology reliant

Banks that measure and manage operational risk are likely

to be less susceptible to systemic problems

10

Rationale Banks Cite for Quantifying

OpRisk continued...
Customers and shareholders demand
operational sophistication, speed, and
flawless execution
Risk modeling that omits (or arbitrarily sets)
capital for operational risk can distort
decision making and performance evaluation

11

Rationale Banks Cite for Quantifying

OpRisk continued...
Allows banks to identify source of
operational losses

Perhaps surprising, many banks do not

routinely track such losses
Causal factor analysis helps manage these
risks

Allows banks to identify operational loss

outcomes that they have exposure to, but
have yet to experience.

example: bad cluster of high frequency, low

impact events
12

Rationale Banks Cite for Quantifying

OpRisk continued...
Provides a framework for modeling extreme
events.

Scenario Analyses of low frequency, high impact

events
example: business interruption

Help incorporate the quantification of risk

reduction into the decision making process

examples: technology, growth, insurance products

13

Goals of Bank Supervisors

Revise international capital accord to
incorporate greater risk sensitivity and
capture significant risks, including op risk
Allocate capital according to a riskfocused approach to the quantification of
operational risk

14

Goals of Bank Supervisors continued...

Provide incentives for banks to measure and
manage operational risks

Promote sound internal policies/controls/ procedures

Motivate investment in operational risk infrastructure
to reduce operational risk

Ensure appropriate consideration of stress

testing/systemic risk

Consideration of systemic implications of operational

risk decisions made by individual firms
15

Basle II Operational Risk Framework

Minimum Regulatory Capital (Pillar 1)

Framework for calculating op risk capital charge

Utilizes spectrum of approaches of increasing
complexity

Sound Practices (Pillar 2)

Basle issued Sound Practices Paper February

2003

Disclosure (Pillar 3)

Market Discipline
Expected to be strong motivator 16

Basle II: Current Op Risk Proposal

Alternative approaches provided to accommodate different levels of
bank sophistication:

Basic Indicator Approach

Standardized Approach

Advanced Measurement Approaches (AMA)

Supervisor Specified Parameters

Supervisor Specified Parameters

Bank Defined Parameters

Bank-wide Measure

Business Line Based

Supervisor Set Qualitative / Quantitative Stds

Exposure Indicator * Alpha

Exposure Indicator * Beta

Significant Flexibility

Exposure Indicator = Gross Income

Exposure Indicator = Gross Income

Examples:

Alpha = 15%

Betas = 12 - 18%

Loss Distribution Approach

Scorecard Approach

Increasing Complexity

Increasing Risk Sensitivity

17

Key Elements of a Basle II AMA

1. Internal Data
2. External Data
3. Scenario Analysis
4. Internal Control and Business
Environment Factors
5. Insurance/Mitigation Techniques
Flexible, framework that builds on banks
internal methodologies and allows for
evolution of practice over time
18

Key Elements of a Basle II AMA

continued...

Qualitative and quantitative supervisory

criteria

Similar approach as Basle Market Risk

Amendment

Key elements can be combined in different

ways to quantify the banks OpRisk exposure
Rely on supervisory validation and
benchmarking across institutions
19

Operational Loss Data

Data collection differs across banks:

The more detail the better, but detail comes at a

$ cost
What kind of tracking system is needed?
Manual? Automated? Training?
Definition? Date information? Insurance payoffs?
Other recoveries?
What is the appropriate $ threshold to capture in
database? Near misses?
How should operational events across business
lines be handled?
20

Operational Loss Data

[1]
Event #
1
2
3
4
5
6
7
8
9
10
.
.
.
.
.
2701
2702
2703
2704

continued...

How should internal data be supplemented with

external data?
[2]
Event
Code (1)
IF
EF
SY
SY
PD
IF
IF
EF
EE
EE
.
.
.
.
.
UA
UA
WS
SF

[3]
Event
Code (1)
12
31
22
11
11
32
22
31
17
27
.
.
.
.
.
8
3
17
26

[4]
Date
960116
960116
960116
960119
960120
960120
960122
960122
960122
960122
.
.
.
.
.
960146
960148
960150
960152

[5]
Cost
Center
10003
20003
33890
45359
11101
10003
20203
19767
19332
18897
.
.
.
.
.
10003
10003
33890
23223

[6]
Business
Line
RB
RB
CF
CF
CB
PS
AS
AS
TS
AS
.
.
.
.
.
RB
RB
CF
AM

[7]

[8]

[9]

[10]

Loss
19057.25
40905.04
10194.55
52831.68
36558.11
620537.37
10181.69
24783.17
11963.49
20086.56
.
.
.
.
.
14451.49
11010.46
24681.18
17963.66

Recoveries
0.00
0.00
3433.00
0.00
0.00
0.00
0.00
13556.00
0.00
0.00

Insurance
19057.25
40905.04
10194.55
52831.68
36558.11
620537.37
10181.69
24783.17
11963.49
20086.56
.
.
.
.
.
14451.49
11010.46
24681.18
17963.66

Event Description

0.00
0.00
0.00
16963.66

21

.
.
.
.
.

Quantification Methodologies
Alternative techniques are available

Chosen technique must include key elements

of AMA: internal data, external data, scenario
analysis, and internal control and business
environment factors
Example 1: Loss Distribution Approach
Models frequency distribution and severity
distribution to formulate an operational loss
distribution
Challenge to understand appropriate modeling
of the tail of the severity distribution
22

Quantification Methodologies continued...

Example 2: Scorecard Approach

Models required capital at the corporate level
Allocates capital pool to business lines based on
scorecard

Other credible methodologies will be acceptable

AMA does NOT preclude alternatives

23

Quantification Methodologies - LDA

The Loss Distribution Approach:

Standard statistical techniques are available

which techniques are most appropriate?
what are appropriate for modeling the tail of the
distribution?

Data Quality is Important

Incorporating high-severity events

External data?
Scenario analysis?
24

Quantification Methodologies - LDA

continued...

Incorporating Risk Mitigation

Insurance coverage can be incorporated into

methodology
uses information about deductibles/limits on
event policies
still have to assess translation into credit/legal
risk

Provides framework to assess appropriateness

of coverage

25

Overview of LDA
Generally, estimation of an operational loss
distribution involves 3 steps:
1. Estimating a frequency distribution
2. Estimating a severity distribution
3. Running a statistical simulation to produce
loss distribution

26

Overview of LDA

continued...

Severity Distribution

D e n s it y

D e n s it y

Frequency Distribution

$ Value of a Loss Events

D e n s ity

Number of Loss Events per Year

25 million

250 million

Expected Loss

Unexpected Loss,
99.9%

Total Operational Loss over a 1 year time horizon

27

Internal Control and Business

Environment Factors
Qualitative Risk Assessments
Developing qualitative operational risk
assessments

Tailored to business line, and are designed to be

real time
and/or forward-looking
Scorecard
business unit asked to answer series of questions
regarding OpRisk

28

Internal Control and Business

Environment Factors
Qualitative Risk Assessments continued...
examples:

What is the number of sensitive positions filled by

temps?
What is the ratio of supervisors to staff?
Does your business unit have confidential client
information?

However, are these scorecards correlated

with true OpRisk exposure?
29

Internal Control and Business

Environment Factors
Key Risk Indicators
Developing systems that track risk
indicators

Real Time indicators

Usually tailored to business line
examples:
employee turnover
number of open employee positions
transaction volume
average transaction size
30

Internal Control and Business

Environment Factors
Key Risk Indicators continued...
However, are these indicators correlated with
OpRisk exposure?
Quantitative Analysis can help assess
relevancy of KRIs

which are drivers

what are important thresholds

31

AMA Should Be Consistent with the

Scope of Application
Applies to internationally active banks as well
as to the entire banking group
Home and host supervisors must be satisfied
that capital reflects the operational risk profile

32

Each Bank Must be Adequately

Capitalized on a Stand-Alone Basis
Capital is generally not freely transferable
within a banking group
Banking groups are allowed to recognize
benefits of group-wide diversification at the
group level
Group-wide diversification benefits cannot be
applied to significant banking subsidiaries
Non-significant bank subsidiaries may be
limited by host supervisor in applying
33
diversification benefits

Supervisors Should Strive to Minimize

the Cost of AMA Cross-Border
Implementation
Institutions can leverage group resources at
the subsidiary level
Subsidiaries can rely on data, parameters and
experts at the parent company with
consideration of specific circumstances of the
legal entity

34

How Should Supervisors Coordinate?

Home supervisor will lead the coordination
effort
Host supervisors will need to be comfortable
with the bank capital in host country

Coordination between home/host countries will be

critical
Allocations will need to be mutually acceptable

35

Implications for emerging markets

To manage a risk you need to be able to
measure it
Operational loss data has been an effective
place to start patterns in data usually lead
to better mitigation
Most effective use tends to be by firms that
use economic capital to manage
Home/Host issues need to be resolved
Largest global banks are moving rapidly to
be ready for implementation
36

Questions?
FRB -- Boston website -more information on OpRisk issues

http://www.bos.frb.org/bankinfo/oprisk

37