Combining likelihood and severity into an overall operational risk assessment

Operational risk measures are not exact in that there is usually no easy way to
combine the individual likelihood of loss and severity assessments into an overall
measure of operational risk within a business unit. To do so, the likelihood of loss
would need to be expressed in numerical terms – e.g. a medium risk represents a
5–10% probability of occurrence. This cannot be accomplished without statistically
significant historical data on operational losses.
The financial industry for the moment measures operational risk using a combination
of both quantitative and qualitative points of view. To be sure, one should strive
to take a quantitative approach based on statistical data. However, where the data
is unavailable or unreliable – and this is the case for many risk sources – a qualitative
approach can be used to generate a risk rating. Neither approach on its own tells the
whole story: the quantitative approach is often too rigid, while the qualitative
approach is often too vague. The hybrid approach requires a numerical assignment
of the amount at risk based on both quantitative and qualitative data.
Ideally, one would also calculate the correlation between the various risk exposures
and incorporate this into the overall measure of business or firm-wide risk. Given
the difficulty of doing this, for the time being risk managers are more likely to simply
aggregate individual seventies assessed for each operational risk exposure.