Operational Risk Management. Operational Risk Management: Plan

Transcription

1 Operational Risk Management VAR Philippe Jorion University of California at Irvine July P.Jorion Please do not reproduce without author s permission Operational Risk Management: Plan (1) Definition and rationale (2) Steps in the management of operational risk (3) The Basel capital charges Philippe Jorion 1

2 Operational Risk: Introduction! Operational risk has been the cause of many failures in the financial industry» Barings, Daiwa, NatWest, AIG, NAB» failures such as Enron, WorldCom are due to poor corporate governance, i.e. operational risk! Many possible definitions:» narrow: risk arising from operations (e.g.trade process)» broader: any risk other than market and credit (but then difficult to identify and control)» Basel definition Definition of Operational Risk! Basel Committee: risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events! This includes legal risk, but excludes strategic and reputational risk where direct losses would be more difficult to ascertain» legal risk includes exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements Philippe Jorion 2

3 Categories of Operational Risk: Basel Event Types! Internal fraud: e.g. AIB, $691m--rogue trader! External fraud: e.g. Republic NY, $166m--custodial client! Employment practices and workplace safety:» e.g. Merrill Lynch, $250m--gender discrimination! Clients, products and business practices:» e.g. Household Intl, $484m--improper lending! Damage to physical assets» e.g. Bank of NY, $140m--Sep 11! Business disruption and system failures» e.g. Salomon, $303m-- unreconciled balances! Execution, delivery and process management» e.g. Bank of America, $225m--system integration failure Rationale for Management of Operational Risk! Operational failures lead to losses! Operational losses lead to greater earnings volatility! Businesses rely more on technology, which can cause more failures! Customers demand operational sophistication! Collection of data leads to better understanding and control of risks! Management of operational risk under the Basel AMA approach leads to lower capital requirements Philippe Jorion 3

4 Management of Operational Risk: New?! Management of operational risk is not new:» traditionally, rely upon internal control mechanisms within business lines, supplemented by the audit function! New aspects:» operational risk now viewed as a separate discipline, along with market and credit risk» emergence of specific structures and processes aimed at managing operational risk! Capital requirement for operational risk:» Basel II rules will impose about 12% capital charge» banks hold about 15% of their capital against OpRisk* Steps in the Management of Operational Risk (1) Identification and assessment (2) Monitoring (3) Control or mitigation (4) Charging economic capital Philippe Jorion 4

5 Identification and Assessment of Operational Risk! Critical self assessment: subjective evaluation of risk by business unit; scorecards estimate probability of losses! Key risk indicators: objective indicators (such as staff turnover, trade volume) that are combined to generate a risk forecast! Measurement: quantification of operational risk loss distribution by using internal and external data on loss experience, along with assessment factors Measuring Operational Risk! Top-down approach looks at the volatility of earnings and subtracts market/credit» backward-looking and not structural model! Bottom-up approach uses actuarial models (from the insurance industry) to build the distribution of losses using» loss frequency, or number of losses /period» loss severity, or size of loss when occurs! Loss distribution obtained from convolution» tabulation method lists all combinations» analytical method derives closed-form distribution» simulation method is most general Philippe Jorion 5

6 Sample Loss Frequency and Loss Severity Distributions Frequency Distribution Probability Frequency Severity Distribution Probability Severity 0.6 $1, $10, $100,000 Nb of First Second Total Losses Loss Loss Loss Probability $1,000 0 $1, *0.6 1 $10,000 0 $10, *0.3 1 $100,000 0 $100, *0.1 2 $1,000 $1,000 $2, *0.6*0.6 Building a Loss Distribution Frequency distribution 1 1 Severity distribution Number of losses (per year) Loss distribution Expected loss $9,500 0 VAR $58,500 $1,000 $10,000 $100,000 Loss size ($ 000s) Loss per year ($ 000s) Philippe Jorion 6

7 Measuring Loss Distributions Source:NetRisk Distribution of Losses Frequency Unexpected loss at 99% level Expected loss Loss Philippe Jorion 7

8 Application! Databases report external losses for U.S. banks above $1 million (scaled in 2002 real dollars)! Distributions similar across data suppliers! Largest losses for Trading & Sales! Largest losses for Internal Fraud, External Fraud, and Clients, Products, and Business Practices (CPB)! Loss severity distribution modeled as f(x) = exp(-x/b)/b where x is ln(x)-ln($1m) and b is tail thickness! For b=0.65 and poor control environment (100 events/yr), capital is $2.1 billion Table 1. Descriptive Statistics by Basel Business Line (Losses in the U.S.) OpRisk Analytics OpVantage % of Percentiles ($M) % of Percentiles ($M) Business Line Losses 50% 75% 95% Losses 50% 75% 95% Corporate Finance 6% % Trading & Sales 9% % Retail Banking 38% % Commercial Banking 21% % Payment & Settlement 1% % Agency Services 2% % Asset Management 5% % Retail Brokerage 17% % Total 100% % Reference: De Fontnouvelle, P., Dejesus-Rueff, V., Jordan, J. and E. Rosengren, 2003, Using Loss Data to Quantify Operational Risk, Working Paper, Federal Reserve Bank of Boston. Philippe Jorion 8

9 Table 2. Descriptive Statistics by Basel Event Type (Losses in the U.S.) OpRisk Analytics OpVantage % of Percentiles ($M) % of Percentiles ($M) Event Type Losses 50% 75% 95% Losses 50% 75% 95% Internal Fraud 23.0% % External Fraud 16.5% % Empl. Practices Work Safety 3.0% % Clients, Products, & Business 55.5% % Damage Phys. Assets 0.4% % Bus Disruption & Syst Failure 0.2% % Execution, Deliv. & Proc.Mgt 1.3% % Total 100.0% % Reference: De Fontnouvelle, P., Dejesus-Rueff, V., Jordan, J. and E. Rosengren, 2003, Using Loss Data to Quantify Operational Risk, Working Paper, Federal Reserve Bank of Boston. Table 3. Capital Estimates (in $ Millions) at the 99.9 percent Confidence Level Average Number of Losses Exceeding $1 Million per Year Business (parameter) Retail (0.55) $400 $400 $500 $600 $600 $700 $700 $800 Banking (0.65) $900 $1,100 $1,300 $1,400 $1,600 $1,800 $1,900 $2,100 Trading (0.75) $2,400 $3,100 $3,600 $4,000 $4,500 $4,900 $5,300 $6,000 Reference: De Fontnouvelle, P., Dejesus-Rueff, V., Jordan, J. and E. Rosengren, 2003, Using Loss Data to Quantify Operational Risk, Working Paper, Federal Reserve Bank of Boston. Philippe Jorion 9

10 Operational Risk Charges Operational Risk Capital Billions ($ or ) Percent of Total JPM Chase $3.5 $ % 11.7% Deutsche Bank % 10.9% Monitoring of Operational Risk! Banks need to have processes to detect and correct deficiencies! Banks should identify risk indicators that are forward-looking! Banks should ensure compliance by regular reviews performed by internal audit and/or risk management Philippe Jorion 10

11 Control/Mitigation of Operational Risk! Banks need to decide whether to control or accept operational risk that are identified! Control involves setting limits! Mitigation involves corrective actions:» loss reduction, or reduction in severity of losses when occur (e.g. with strategies such as contingency planning)» loss prevention, or reduction in frequency of occurrences (purchasing better equipment, setting up quality control systems) Practical Experiences from the Financial Industry! Operational risk is greater in some situations ( 35):»new products (esp. relative to core business strategies)»unfamiliar markets»geographically distant locations!more difficult to control!problematic with national board composition! Independence of functions is fundamental:»chief risk officer»chief governance officer»chief compliance officer (but effectiveness vs. independence)! Rotation of employees/auditors is useful Philippe Jorion 11

12 Funding Operational Risk! Financing of unexpected losses (1) Preloss financing: builds a reserve in anticipation of risk losses (2) Postloss financing: absorbs a loss after it occurs,» self-insurance (retaining risk), using equity capital» external insurance (transferring risk), where the issue is the cost of insurance Rationale for Supervision of Operational Risk! Many bank failures can be traced to operational risk, which can become a systemic issue! Properly allocate capital to reflect risks! Provide incentives for banks to manage operational risk» promote sound policies» motivate investment in operational risk infrastructure! More advanced approaches lead to lower capital charge Philippe Jorion 12

13 Basel Sound Practices (1) The board of directors should approve and periodically review the bank s operational risk management framework. (2) The board of directors should ensure effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. (3) Senior management has responsibility for implementing the operational risk management framework (4-7) Banks should manage op risk (10) Banks should make sufficient public disclosures Basel Capital Charges for Operational Risk (1) (1) Basic indicator approach: based on an aggregate measure of business activity! The capital charge is a fixed percentage (α=15%) of the exposure indicator (EI), gross income K BIA = EI α! Pros: simple, transparent, and uses available data! Cons: does not account for the quality of controls! As a result, this approach is expected to be mainly used by non-sophisticated banks Philippe Jorion 13

14 Basel Capital Charges for Operational Risk (2) (2) Standardized approach: based on standardized business units! For each business line, multiply the EI by a fixed percentage (beta factor) and sum K = EI β SA i i i! This approach better reflects different risks! Used if the bank can demonstrate effective management of op risk Corporate finance Trading and sales Retail banking Commercial banking Payment and settlement Agency services Asset management Retail brokerage 18% 18% 12% 15% 18% 15% 12% 12% Basel Capital Charges for Operational Risk (3) (2) Advanced measurement approach (AMA): based on banks own internal models! Banks compute the distribution of operational losses over a one-year horizon, taking into account diversification effects, and report an Expected Loss (EL) and Unexpected Loss (UL) K AMA = UL = VAR(1 year,99.9%)» provided EL has been accounted for! Only when the bank demonstrates effective management of op risk; expected to be used by more sophisticated institutions Philippe Jorion 14

15 Elements of AMA Banks should use: (1) Internal data, specific to the bank which now need to be collected (2) External data, which are useful for gathering information on low-frequency, high-severity events (3) Scenario analysis, to consider extreme events not in historical data (4) Internal controls and business environment factor, to adapt to quality of controls in different banks (5) Insurance, to cover up to 20% of capital (but subject to litigation) Conclusions! Operational risk is now the focus of attention of the banking system! Spurred by regulators, the industry has made tremendous progress in methodologies! The first step in the management of any risk is to try to measure it! Perhaps the most difficult part is to collect internal data in a systematic way! Quantification approaches are based on insurance methodologies and Value at Risk Philippe Jorion 15

16 Bibliography! Basel Committee on Banking Supervision, 2004, International Convergence of Capital Measurement and Capital Standards: A Revised Framework! Basel Committee on Banking Supervision, 2003, Sound Practices for the Management and Supervision of Operational Risk (February)» Patrick de Fontnouvelle, Virginia DeJesus-Rueff, John Jordan, and Eric Rosengren, 2003, Capital and Risk: New Evidence on Implications of Large Operational Losses, FRB Boston Series 03-5» References! Philippe Jorion is Professor of Finance at the Graduate School of Management at the University of California at Irvine! Author of Value at Risk, published by McGraw-Hill in 1997, which has become an industry standard, translated into 7 other languages; revised in 2000! Author of the Financial Risk Manager Handbook, published by Wiley and exclusive text for the FRM exam; revised in 2003! Editor of the Journal of Risk! Some of this material is based on the online "market risk management" course developed by the Derivatives Institute; for more info, visit or call Phone: (949) FAX: (949) pjorion@uci.edu Web: Philippe Jorion 16