Document and collect data

It is essential to observe causes as well as effects (losses) otherwise you will end up
with a database of useless information. A lack of internal controls such as segregation
of duties is a cause. A loss event such as fraud is the effect.
In order to identify the causes and effects of operational risk it is essential to
take the approach advocated above of splitting operational risk into ‘risk subcategories’,
e.g.:
Ω Tied into departments/divisions
Ω Tied into the existing internal control framework and processes
However, a better approach is to start with a ‘blank-page’ and brainstorm a long
list of categories with their causes and effects with the business concerned (bottomup
approach) or at a corporate level (top-down).
The advantage of the top-down approach is that the results can be used to
comply with regulation/audit guidelines such as COSO. Bottom-up (perhaps using
a modified version of Control Self-assessment) is advantageous as it obtains the buyin
of the business. For a number of different risk categories we have analyzed the
potential losses and possible causes shown in Table 13.3.
It is much easier to collect loss or effect data than to collect than the causes of loss
data. Most banks start by collecting the losses and then try to fit the causes to them,
developing a methodology later. A number of insurers have large databases of
causes such as earthquakes and separate databases of loss/claims made. They have
developed techniques to fit causes to effects. However, it is a major problem as there
may be many causes to one loss or probability driver. The relationship can be highly
subjective and the importance of each cause on the effect difficult to assess. Sources
of loss data are contained in Table 13.4.
After loss and cause data has been collected, empirical analysis may be used to
assess the link between the causes and effects. It is essential to group similar losses
together in order to measure the frequency of the different causes. A distribution of
causes can be made with the most frequent being the main cause. This will then
enable remedial management action to be taken on a prioritized basis. However,
there may be dependencies between causes in which case the use of root-cause
analysis may be appropriate to find the start of the chain.

Some banks split losses between high-frequency low-impact and high-impact lowfrequency
events. The high-impact events are usually the catastrophic ones. Few
banks have much internal data on the latter loss (or they would be out of business).
Therefore there is a need to use external as well as internal data. High-frequency
low-impact events lend themselves to statistical modeling. The treatment of highimpact
low-frequency events, particularly if the data is about an event in another
bank, is more open.
The types of data collected can be divided into four main sources:
Ω Historical variances/loss events (past settlement losses from the back office)
Ω Supplier/vendor estimates
Ω Industry benchmarking (competitors’ average failure rate on trades per 1000)
Ω Delphic techniques based upon business assessment.
The last technique is the preferred method of the causal model, particularly when
there is a general lack of data from the other three methods. The delphic oracle was
the priestess who was able to predict the future based upon her superior knowledge
and forsight. The delphic technique involves gathering a panel of experts together in
the bank and forcing them to look forward in time, usually for the next financial year
and getting them to generate scenarios of what can go wrong in terms of causes,
effects, magnitude and likelihood. By forcing the senior executives to place a value
on the scenarios the link is made between the qualitative and quantitative methods
of measuring operational risk. The results of the delphic workshops can be calibrated
against internal and external databases at a later date but this method results in a
quick implementation of a quasi-quantitative method of measuring operational risk
and gets the essential buy-in of the business.