Integrated operational risk

At present, most financial institutions have one set of rules to measure market risk,
a second set of rules to measure credit risk, and are just beginning to develop a third
set of rules to measure operational risk. It seems likely that the leading banks will
work to integrate these methodologies (Figure 12.15). For example, they might
attempt to first integrate market risk VaR and credit risk VaR and subsequently
work to integrate an operational risk VaR measure.

Developing an integrated risk measurement model will have important implications
from both a risk transparency and a regulatory capital perspective. For example, if
one simply added a market risk VaR plus an operational risk VaR plus a credit risk
VaR to obtain a total VaR (rather than developing an integrated model) then one
would overstate the amount of risk. The summing ignores the interaction or correlation
between market risk, credit risk and operational risk.
The Bank for International Settlement (1988) rules for capital adequacy are generally
recognized to be quite flawed. We would expect that in time regulators will allow
banks to use their own internal models to calculate a credit risk VaR to replace the
BIS (1988) rules, in the same way that the BIS 1998 Accord allowed banks to adopt
an internal models approach for determining the minimum required regulatory
capital for trading market risk. For example, we would expect in the near term that
BIS would allow banks to use their own internal risk-grading system for purposes of
arriving at the minimum required regulatory capital for credit risk.

The banking industry, rather than the regulators, sponsored the original market
VaR methodology. (In particular, J. P. Morgan’s release of its RiskMetrics product.)
Industry has also sponsored the new wave of credit VaR methodologies such as the J. P. Morgan CreditMetrics offering, and CreditRiskò from Credit Suisse Financial
Products. Similarly, vendor-led credit VaR packages include a package developed by
KMV (which is now in use at 60 financial institutions). The KMV model is based on
an expanded version of the Merton model to allow for an empirically accurate
approximation in lieu of a theoretically precise approach. All this suggests that, in
time the banking industry will sponsor some form of operational risk VaR
methodology.

We can push the parallel a little further. The financial community, with the advent
of products such as credit derivatives, is increasingly moving towards valuing loan
products on a mark-to-model basis. Similarly, with the advent of insurance products
we will see increased price discovery for operational risk. Moreover, just as we have
seen an increasing trend toward applying market-risk-style quantification techniques
to measure the credit VaR, we can also expect to see such techniques applied to
develop an operational risk VaR. Accounting firms (such as Arthur Anderson) are
encouraging the development of a common taxonomy of risk (see Appendix 6).
Consulting firms (such as Net Risk) are facilitating access to operational risk data
(see Appendix 7).

A major challenge for banks is to produce comprehensible and practical approaches
to operational risk that will prove acceptable to the regulatory community. Ideally,
the integrated risk model of the future will align the regulatory capital approach to
operational risk with the economic capital approach.