Operational Risk - Measurement?

Austega was one of the pioneers in operational risk measurement

Perspective

"...Banks should aim at much more than simply minimising regulatory capital in their operational risk management.

...Operational risk management should first and foremost be an effort to measure and control operational risk, rather than an exercise in efficient capital allocation and arbitrage.

...Truly effective operational risk management will continue to remain primarily underpinned by qualitatively stronger elements such as solid corporate governance,healthy risk culture throughout the organisation,effective operational risk management at all levels,tight procedures and controls,performing technology,and not least well qualified and honest people ."
- Samuel Theodore, Bank Operational Risk Management, Moody's June 2002.

Why measurement?

Why attempt to measure operational risk? Why try to put dollar values (or even relative rankings) on risks that contain so many intangible elements?

It certainly breaks new ground, and the methodology needs to be regularly reviewed and improved, but it needs to be done. Measuring operational risk on a holistic enterprise-wide basis brings many benefits to banks:

it allows a bank's risk management and audit focus to become more proportional to the potential pain (it is unfortunately surprising how some risks are overmanaged while others are largely ignored)
it allows performance metrics to be expressed fully on a risk/return basis and aligned with the creation of shareholder wealth
it supports a risk-aware culture in the business, without a "dead hand" of caution
it allows profitable businesses, products, customer groups and delivery channels to be more accurately identified and then dominated, leaving loss-making areas to one's competitors
it allows the risk diversification benefits and costs of mergers, acquisitions and divestments to be sensibly estimated

Critical state theory or are there operational risk patterns?

The most significant argument against measuring operational risk is not the difficulty with definitions, data or gaining management buy-in, but the fundamental question of whether operational risk shows a statistical pattern at all? Is the question of how to find the best estimation method for the underlying frequency and severity of operating and business losses missing the point that there is no stable underlying frequency and severity?

Proponents of critical state theory suggest that the financial world may absorb stresses like a mountain slope takes additional snow - at some point determined by a multitude of environmental factors there is a sudden and relatively unpredictable collapse. Moreover some have suggested that endeavors to regulate or control these collapses inevitably only make the avalanche more devastating when it does occur.

Certainly when considering the significant business risks it is naive to ignore the influence of environmental factors such as politics, technology and social trends. We feel that the idea of stresses being absorbed to a point of breakage also has significant merit. Consequently we feel that any measurement of operational risk should be accompanied by a wariness to early confidence that risk has been fully "captured". A risk manager also needs to be a student of history and a visionary for the future.

Nonetheless within this context measurement of operational risk helps to understand the relative scale and dimensions of the risks, and remains an essential foundation to responding to their challenge.

Holistic vs Basel - an issue?

There is a sharp distinction between the initial requirements under the Basel proposed accord and the goals of a full measurement of risk. Basel is restricting its definition of operational risk to exclude business and strategic risks. While this has several advantages, it doesn't provide a complete picture of an business' risk profile - and this is necessary for many of the strategic advantages listed above.

Advanced institutions are responding to both challenges: ensuring they can meet the regulatory capital measurement requirements while also holistically quantifying the enterprise's risks other than those already measured (such as credit and market risks).

There are still many issues being resolved. But banks are learning by doing, and some banks are well on their way.

Austega led the development of a direct estimation measurement method in 1997 in a leading bank. It is a goal-oriented first principles approach that borrows from the ways that credit and market risk are measured (and thereby ensures a common risk metric). It provides a method to estimate operational risk capital for an entire organization, prior to the collection of sufficient clean data to support an empirical estimation. It is a cost-effective holistic, whole of organization approach providing a solid foundation for risk-aware management of financial (and other) organizations.

This method can work well in tandem with the simple indicator and loss data collection approaches in the Basel proposed accord. Indicators can be developed from integrated financial planning and other data as a strong risk management reporting tool to Board members and senior executive. Loss data collection can be readily developed to include business and strategic risk departures from planned outcomes. While it will be many years before the loss data is able to support rigorous statistical modeling, in the meantime it supports a "virtuous circle" that improves measurement accuracy by informing the risk estimation process.

Measuring risk by the "direct estimation" or scenario method

Managing risk in large organizations

Measurement is not enough. Boards and senior executive can no longer fulfill their responsibilities by simply delegating responsibility for risk management to line managers. Their accountability for managing an organization (for example as redefined by the UK's Turnbull report) means they need to be able to demonstrate how they managed the entity's significant risks.

Qualitative reporting by those delegated with the active management of the risk, supported by relatively objective risk management reporting, provides both the demonstration of board/senior executive action, and also ensures a clear risk accountable message throughout the organization. This risk management reporting provide early alerts for when an environmental assumption or variable on which a risk assessment was based changes, and can be combined with trigger alert levels if desired.

To Defining Operational Risk

Last updated:16/5/07

Jump to... Top | Risk Management Home | Austega Home