Measuring operational risk

This section will investigate the various methods of measuring operational risk
including risk ranking, checklists, and the balanced scorecard approach. It will also
put forward ideas updated since the author’s first paper on applying Value at Risk
techniques to operational risk published in Risk (December 1995). The section will
review the latest techniques applied to a practical example such as the costs of late
payments due to operational failures.
The Basel Committee on Banking Supervision in their report of September 1998
interviewed thirty major banks on the key issues in operational risk. In relation to
operational risk measurement their report states:
Many banks have identified significant conceptual issues and data needs, which would
need to be addressed in order to develop general measures of operational risk. Unlike
market and perhaps credit risk, risk factors are largely internal to the bank and a clear
mathematical or statistical link between risk factors and the likelihood and size of operational loss does not exist. Experience with large losses is infrequent and many banks
lack a time series of historical data on their own operational losses and their causes.
While the industry is far from converging on a set of standard models, such as are
increasingly available for market and credit risk measurement, the banks that have
developed or are developing models rely on a surprisingly similar set of risk factors. Those
factors include internal audit ratings or internal control self-assessments, operational
indicators such as volume, turnover or rate of errors, loss experience, and income
volatility.
Therefore the key tasks to be addressed by any measurement method are the:
Ω identification of an approach to clearly describe operational exposures, risk factors
and potential losses
Ω establishment of a relationship between exposures, risk factors, and potential
losses
Ω treatment of high-frequency low-impact events and low-frequency high-impact
events
Ω incorporation of the resulting model and reports into the key business and
management processes of the firm.
When analyzing market or credit risk many institutions take a ‘step-wise’ approach
as follows:
Ω Define risk
Ω Identify risk factors
Ω Measure exposures to those risk factors
Ω Calculate risk (dependent on a number of assumptions such as: the particular
application of the risk factors to exposure, time exposed to them and confidence
level assumed)
Table 13.2 takes the step-wise approaches to analyzing market and credit risk and
compares this to a similar approach for operational risk.
Unfortunately, as we can see from the table, the comparison is not an easy one to
make because market risk Value at Risk quantification techniques have been
accepted for many years as best practice. Credit VaR methods are only just being
piloted in only a handful of banks for the first time. These new methods are not
accepted as best practice but by the end of 2000 or 2001 we should see some
regulatory flexibility in using internal credit VaR models for calculating regulatory
capital. This will then lead to Credit VaR being the benchmark in credit risk
measurement.
Where, you may ask, does this comparison leave operational risk? There is little
alternative but to implement quantitative or semi-quantitiative methods of measuring
operational risk. However, there are a number of methods available and currently no
consensus on which is best practice.
Another approach to measuring operational risk is to analyze the volatility of
earnings, take out the earnings related to market and credit risk. The residual risk
may be considered to be operational risk. This approach has the advantage that you
are able to relate operational risk to the earnings of the company. Unfortunately it is
impossible to measure the individual operational risk factors which cause residual
earnings to be volatile without implementing some form of causal model earnings
volatility or operational risk losses. It is also not easy to segregate volatility of
earnings due to market, credit and strategic business risks.