International Trade and Finance Association COMPARATIVE ANALYSIS OF OPERATIONAL RISK MEASUREMENT TECHNIQUES

Transcription

1 International Trade and Finance Association International Trade and Finance Association 15th International Conference Year 2005 Paper 39 COMPARATIVE ANALYSIS OF OPERATIONAL RISK MEASUREMENT TECHNIQUES Dilek Teker Istanbul Technical University This working paper site is hosted by The Berkeley Electronic Press (bepress) and may not be commercially reproduced without the publisher s permission. Copyright c 2005 by the author.

2 COMPARATIVE ANALYSIS OF OPERATIONAL RISK MEASUREMENT TECHNIQUES Abstract The banking risks have been known as a total of credit and market risks for a long time. The banking sector has come across the operational risk by the occurance of financial crises in recent years. Operational risk may simply be defined as all risks other than credit and market risks, banks incur in their operations. On the other hand, the Basel Comittee defines operational risk as the loss resulting from inadequate or failed internal processes, people, systems or external events. By the official announcement of Basel II in June 2004, measuring and managing operational risk and including in banks capital adequacy computations became one of the hot topics in banking sector. The aim of this research is to present factors resulting operational risk and examine various operational risk measurement models and compare the level of efficiency of the underlying models in terms of capital requirement. Furthermore, each model is applied on a bank operating currently in the Turkish banking sector. The results support that the use of advanced risk measurement models reduces the capital needs of the bank under examination. Presented at the 15th International Conference,Istanbul, Turkey, May 2005.

3 INTRODUCTION The occurance of remarkable financial crises in the last two decades could mainly be charged to technological developments and complexity of new financial products and services. The apperant intension of banks was to minimize the negative effects of these fast developments in the financial sector. The Basel Committee set the definition of operational risk as the loss resulting from inadequate or failed internal processes, people, systems or external events. By the Committee s definition, the factors resulting operational risks are grouped in four areas as human, systems, processes and external events. By the official announcement of Basel II in June 2004, measuring and managing operational risk and including in banks capital adequacy computations became one of the hot issues in banking. Basel II requires that the international banks operating in G-10 countries begin employing the new capital standards by the year Nevertheless, global competition, international integration and market discipline are expected to force other countries to implement Basel II capital standards following closely G-10 countries. These recent developments have also obliged the Turkish banks to adopt the changes in international financial markets and required to constitute an adequate operational risk management framework. In order to manage operational risks effectively, banks are first required to find out their operational risk profiles and pinpoint which of their operations lead operational risks. After identifying and classifying the operational risk factors, banks need to measure their risks adequately and allocate sufficient amount of risk based capital. Basel Committee defines three different approaches for measurement of operational risk; namely, basic indicator approach, standardised approach and advanced measurement approach. This study initially discloses the factors causing operational risk in banks, and then demonstrates the application of various risk measurement approaches on a bank operating in the Turkish banking sector, and finally compares the effects of the application of each model on the underlying Turkish bank s risk based capital requirement. OPERATIONAL RISK FACTORS In order to quantify operational risk, operational risk factors first need to be categorized. Capital adequacy standards of banks known as Basel II classifies the risk factors resulting operational risks in banks as human, system, processes and external factors. Each of these risk factors is explained below. HUMAN Hosted by The Berkeley Electronic Press

4 Human factor causing operational risk is subcategorised as the employee s error, employee s fraud, act of employee s conflict to Employment Law and loss or lack of qualified personnel. Employee s error is generally defined as losses resulting from incorrect actions of the staff. Fraud are losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, law or bank policy, excluding discrimination events which involve at least one internal party. Fraud includes collusion, embezzlement and money laundering. The act of employee s conflicting to Employment Law is explained as the losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity or discrimination events. Another subfactor for human category is the loss or lack of key personnel. If qualified employees are not available internally, then a bank may loose clients because of poor service quality. In order to lower the impacts of operational risk due to human factor; the strong internal control and auditing is an effective strategy as well as restructuring an effective salary policy. Furthermore, banks could avoid human errors by adequately training staff on new products and services (Marshall, 2001). SYSTEM System risk is defined as the loss that the bank incur because of virus attacks, system breakdowns, capacity problems and lack of security. With the new trends in recent years in financial markets, the operational systems of banks have looked insufficient to handle the complex high volume operations. Therefore, banks have recently shown a strong tendency to restructure their operational systems. However, banks may face a significant amount of loss data during restructuring process (Pennathur, 2001). Operational losses occuring because of deficient systems are classified into four subgroups; technology and investment risk, system development and orientation risk, lack of capacity problems and system security problems. Technology and investment risk is defined as the losses banks may incur because of investing in unqualified softwares. System development and orientation risk is defined as the losses resulting from the inefficient use of softwares due to improper design. Lack of capacity problems is grouped as network errors, insufficient memory and database problems. If there occurs capacity problems, the transaction processes may breakdown and hence banks incur operational losses. System security is another type of operational risks resulting from the bank s system. If a bank s system is not guarded properly against unauthorized external or internal access, banking data in the system may be manipulated or the system and the network may be hacked (Porter,2003). A good example for this could be the illegal wire transfers of a group of Russian

5 computer hackers out of Citibank in 1995 costing Citibank $10 million. All, but only $400,000 was ultimately recovered by Citibank. After this, Citibank lost 20 of its top clients claiming the need for more stringent security which also cost Citibank even larger indirect losses (Marshall, 2001). Most of the times banks prefer to delay investing for restructuring or developing their systems. However, weaknesses of the systems may oblige banks to compensate much larger amounts of losses than banks would otherwise pay for investing in their systems. PROCESSES Banks constitute internal control units in order to prevent from operational risks. However, in the case of insufficient internal control or misimplementation, banks incur operational risks. Operational risks occurring as a result of processes are classified as documentation risk, contract risk, modeling risk and lack of internal or external reporting (Brink, 2002). Documentation risk is explained by the missing documents not kept during the required time period. Contract risk indicates the losses occur because of wrong or inadequate contract terms. Modeling risk refers to misleading customers with improper consultancy. Lack of internal or external reporting is explained by inadequate exception reporting, accounting failures, inadequate risk management reporting and inadequate regulatory reporting. Processes are the central focus for the diagnosis of operational risk. However, it is practically impossible to check out all banking procedures in detail. Thus, banks are suggested to make a quick scan that is limited to considerably important procedures. EXTERNAL FACTORS External factors causing operational risk are grouped in four areas as legal and political risk, criminal activities, outsourcing risk and losses from disasters (Brink, 2002). Legal and political risk is explained as breach of environmental management, regulatory changes in law and war risk. Criminal activities include external fraud, fraudulent account opened by clients, blackmail, robberies, money laundering, terrorism and physical damage to property. Outsourcing risk occurs because of bankruptcy of suppliers or breach of service agreement. Disasters is the last external factor causing operational risk including flood, civil disasters, energy failure, earthquake, volcano and hurricane. In order to manage operational risk effectively, banks are first ought to determine which of these risk factors they incur in their operations. The second Hosted by The Berkeley Electronic Press

6 step, banks need to measure the magnitude of their operational risk and allocate sufficient amount of capital. Finally, banks need to build strategies to minimize the effects of operational risk factors. The models to be used in measuring and allocating capital for operational risks are explained in the following section. MEASURING AND ALLOCATING CAPITAL FOR OPERATIONAL RISK In 1988 Basel Committee issued the first Capital Accord known as Basel I. Basel I included only credit risk in measurement of banks capital adequacy ratio. Although Basel I targeted the application only on international banks, it was overly accepted by almost all countries and all local banks. However, Basel I standards were deeply criticized for its deficiencies for not discriminating good and risky banks, not considering portfolio effects and not allocating flexible risk weights. For a reply to these critics, Basel Committee first proposed new banking capital standards known as Basel II six years ago. Since then the proposal was revised a number of times based on the comments of parties in interest. Finally the new standards were made public in June The capital allocation for operational risk is required in the new standards. The new accord defines three different approaches for operational risk measurement; namely, basic indicator approach, standardized approach and advanced measurement approach. BASIC INDICATOR APPROACH (BIA) Basic indicator approach bases the capital charge for operational risk on a fixed percentage (B-alpha) of an exposure indicator. The exposure indicator is the average gross income over the previous three years while alpha is charged as 15 %. The gross income is calculated as the sum of net interest income and net non interest income. It is intended that this measure should be gross of any provisions, and operating expenses. Also, it should exclude realized profits/losses from sale of securities in the banking book and extraordinary or irregular items. According to basic indicator approach, the capital requirement for operational risk can be calculated as below (Basel Committee, 2003): C BIA = (GI)() 2.1 where GI is the average gross income and is the fixed multiplier as %15. Beyond the practical easiness of basic indicator approach, it is not recommended to large scaled international banks due to incapability of the model in measuring operational risk effectively and generating high net non interest income.

7 STANDARDISED APPROACH Standardized approach represents a further refinement along the evolutionary spectrum of approaches for operational risk capital. Likewise basic indicator approach, standardized approach measures and bases the required capital charge on bank s average gross income but sets various fixed percentages (-beta) for each of predefined business lines. The business lines are named as corporate finance, trading and sales, retail banking, commercial banking, payment and settlements, agency services, asset management and retail brokerage. Thus, standardized approach is an improvement over basic indicator approach in differentiating risk profiles of a bank s broad business activities. For each business line, the Basel Committee specifies exposure indicators as average gross incomes over previous three years. The capital required for each business line is calculated by multiplying the average gross income and the beta set by the Committee. The total capital charge is calculated as the simple summation of capital charges across business lines (Marshall, 2001). The calculation is summarized in table 2.1. Table 2.1: Calculation of Capital Requirement in Standardized Approach Business Lines Exposure Indicator Capital Requirement (GI i * j ) Corporate Finance GI 1 % 18 GI 1 * 0.18 Trading and Sales GI 2 % 18 GI 2 * 0.18 Retail Banking GI 3 % 12 GI 3 * 0.12 Commercial Banking GI 4 % 15 GI 4 * 0.15 Payments and Settlements GI 5 % 18 GI 5 * 0.18 Agency Services GI 6 % 15 GI 6 *0.15 Asset Management GI 7 % 12 GI 7 *0.12 Retail Brokerage GI 8 % 12 GI 8 *0.12 Total Capital Requirement (C SA ) ( GI i )( j ) ADVANCED MEASUREMENT APPROACH (AMA) Basic indicator approach and standardized approach base the amount of operational risk as a multiple of gross income. Therefore, banks with high gross incomes are supposed to incur high operational risk. Assuming each of two banks Hosted by The Berkeley Electronic Press

8 generates $100,000 average gross income. However, one of the banks has a much smaller client portfolio and generates its small proportion of gross income by providing services to its few clients while the other bank generates its large proportion of gross income via high number of client transactions. Under basic indicator approach and standardized approach, both banks are expected to face a similar level of operational risk. However, operational risk is closely related with transaction volume of banks. Therefore, first two approaches may not reflect proper amount of operational risk the banks incur. Banks need an effective operational risk management technique that provides effective measurement and capital requirement calculation. AMA is the only approach supporting banks with information about operational risk factors they incur. Although many banks would currently like to use AMA, only few banks could manage it so far. In order to implement AMA, a bank needs to first constitute a detailed operational loss database concerning loss time, loss details, loss amounts and percentage of losses recovered and not covered. However, it is known that only a few international banks in the world own a detailed loss data capturing system. Basel Committee requires banks to have at least a minimum of five year loss database for application of AMA but for an initial transition period a three year database is also acceptable. Against its complexity in implementation, advanced measurement approach is more risk sensitive and effective in risk based capital allocation. The belief in implementation of AMA is its advantage on savings bank s capital in the long run. Internal measurement approach and loss distribution approach are two models applied under AMA. INTERNAL MEASUREMENT APPROACH (IMA) The internal measurement approach (IMA) provides discretion to individual banks on the use of internal loss data. In implementing this approach, banks are required to prove the regulators that bank follows the qualitative and quantitative standards set by the Basel Committee which ensures the integrity of measurement, data quality and adequacy of the internal control unit. Basel Committee first introduced IMA in Consultative Paper 2.5 (Regulatory Treatment of Operational Risk) in In IMA application, banks build an operational risk matrix with 56 cells including eight predefined business lines in standardized approach by seven operational risk factors proposed by the Committee. The underlying matrix is illustrated in table

9 Table 2.2: Operational Risk Matrix under IMA Risk Factor (i) Internal Fraud External Fraud Employment Practices and Workplace Safety Clients, Products & Business Practices Damage to Physical Assets Business Disruption and System Failures Execution Delivery & Process Management Business Lines (j) Corporate Finance Trading and Sales Retail Banking Comm. Banking Payments and Settl. Agency Services Asset Mngmt. Retail Brkrg. Each cell in the matrix represents the capital required for business line/risk type of a bank. The total capital required for operational risk is the simple summation of capital calculated for each cell. However, Basel Committee encourages all banks to use IMA and prepare their own operational risk matrixes since operational risk factors could vary among banks. In order to get total capital requirement under IMA, banks ought to calculate some parameters using their internal datasets by following steps below: Step 1: Bank calculates the average gross income over previous three years as exposure indicator (EI) for each business line (the same with the amounts calculated under standardized approach). Step 2: Bank calculates probability of loss event (PE) that represents the probability of occurance of loss events and loss of given event (LGE) that represents the proportion of transaction or exposure that would be expensed as loss, given that event (Basel Committee, 2001). PE parameter can be calculated as in formula 2.2 (Basel Committee, 2003). PE i,j = Number of transactions concluded with operational risk (2.2) Total number of transaction in the business line where i is business line and j is risk factor. Hosted by The Berkeley Electronic Press

10 Loss of given event (LGE) is calculated by the following formula 2.3 (Basel Committee, 2003). LGE i,j = Operational loss couldn t be recovered in each business line/risk factor ($) (2.3) Total operational loss in each business line/risk factor ($) As defined above, LGE represents the ratio that the bank records as losses in the case of occurance of an operational risk event. In other words, LGE is the loss percentage that can not be recovered. For example, a bank may incur an internal fraud of $10 million in payments and settlements business line. However, bank may recover $4 million of its total losses by insurance coverage and finally recognize only $6 million as operational loss. Therefore, the LGE parameter in payment and settlement/internal fraud cell in the matrix is determined to be %60. Step 3: Calculating expected loss (EL) in each business line/risk factor in the matrix. Expected loss amount is produced by the multiplication of EI, PE and LGE of each business line/risk factor in the matrix. The EL is illustrated in formula 2.4. EL i,j = EI i * PE i,j * LGE i,j ( 2.4) Step 4: Basel Committee requires banks to allocate capital for operational risk in An amount of sum of expected and unexpected losses. Banks calculate their unexpected losses by a multiplication of a gamma (J) factor and the amount of expected loss. The gamma factor denotes the maximum amount of loss for a holding period within a certain confidence level. In Consultative Paper 2, Basel Committee indicates that the scale of J will be determined and fixed by the supervisors for each business line/ risk factor. However, the suggestion of the Committee is critised. It is widely accepted that the gamma for each bank could be different (Alexander, 2001). Thus, banks should calculate their own gammas by using their internal loss data. Below is the formula for gamma factor computation (Pezier and Alexander, 2001). 2 i, j 1 + ( L / µ L ) k Gamma = (2.5) Np i, j

11 µ L is the expected loss, L is the standard deviation of loss, Np is the number of operational risk event occured in a period of time, and k is the multiplier for business line i and risk factor j. Banks with adequate internal loss database may easily apply the above formula using mean (µ L ) and standart deviation ( L ) parameters and calculate their own internal gamma factors. However, banks not possessing adequate internal loss database to calculate the mean and the standard deviation are suggested to apply the formula 2.6 below (Pezier and Alexander, 2001). ki, j Gamma = (2.6) Np This formula enables a bank to calculate its internal gamma factor without estimating µ L and L parameters. The factor k in the formulas 3.5 and 3.6 denotes the ratio of unexpected loss to. In calculation of factor k, banks first forecast the loss distribution of each business line/risk factor cell in the matrix. The three known probability distributions are usually suggested to be used in operational risk models are standard normal, binomial and poisson. If a bank forecasts its loss distribution as standard normal, simply the table value of the determined confidence level is assumed to be equal to factor k. The confidence level is recommended as 99.9% in operational risk measurement models, hence the value of k is equal to If a bank forecasts its loss distribution as binomial, first the bank is required to calculate the standard deviation of the losses as in formula 2.7 (Pezier and Alexander, 2001). = Np 1 p ) (2.7) i, j i, j ( i, j where Np is the number of operational risk event occured in a period of time, p is the probability of an event incurred operational risk for business line i and risk factor j. The factor k is calculated as follows using the standard deviation (Pezier and Alexander, 2001). t Npi, j ki, j = (2.8) where Np is the number of operational risk event occurred in a period of time, t is the table value for confidence level in binomial distribution and K is the standard deviation. Another distribution to be used in operational risk measurement is poisson distribution. Poisson distribution is usually suggested to be used for operational loss events with low probability but high severity. In poisson distributions, the Hosted by The Berkeley Electronic Press

12 standart deviation is i, j which stands for the number of operational risk event occurred in a period of time as Np in binomial distribution. The factor k is calculated as follows (Alexander, 2001). t i, j k = (2.9) where i, j is the number of operational risk event occurred in a period of time, t is the table value for confidence level in poisson distributions and is standard deviation. By replacing the value of k in the gamma formula, the bank generates the gamma factors for each cell in the operational risk matrix. Multiplying each gamma factor by the expected losses of each business line/risk factor cell in the matrix, a bank produces unexpected loss values as illustrated in formula UL = L i L j [(J i,j ) (EI i ) (PE i,j ) (LGE i,j )] (2.10) Basel Committee requires banks to allocate capital for operational risks in an amount of the sum of expected and unexpected losses (Basel Committee, 2004). Thus total capital requirement is simply the sum of expected and unexpected losses in each cell of the matrix (Table 2.3). Table 2.3: Total Capital Requirement for Operational Risk under IMA Business Lines Corporate Finance Risk Factor Internal Fraud EL i,j+ul i,j External Fraud Employment Practices and Workplace Safety Clients, Products & Business Practices Damage to Physical Assets Business Disruption and System Failures Execution Delivery & Process Management EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Trading and Sales EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Retail Banking EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Commercial Banking EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Paym. & Settlements EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Agency Services EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Asset Management EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Retail Brokerage EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j EL i,j+ul i,j Total Cap. Requir., (EL i,j+ul i,j)

13 LOSS DISTRIBUTION APPROACH (LDA) Under LDA, a bank using its internal data estimates the probability distributions for the loss frequency and the event impact of each business line/ risk factor. Based on the two estimated distributions, bank can estimate its probability distribution function of the cumulative operational loss as illustrated in Figure 2.1. Figure 2.1: Steps to Produce Cumulative Loss Distribution of a Bank Cumulative Loss Distribution Unexpected Loss 99.9 % Confidence Level Annual Loss Frequency Distribution Severity Distribution Number of Events Occured Similar to internal measurement approach, Basel Committee requires banks to constitute their operational risk matrix in loss distribution approach. The aim of this model is to calculate Operational Value-at-Risk (OpVaR) through the estimated cumulative loss distributions for each business line/risk factor cell in the matrix. The capital requirement is the simple sum of each OpVaR in the matrix as illustrated in Table 2.4. Hosted by The Berkeley Electronic Press

14 Table 2.4: Application of Loss Distribution Approach Business Lines Risk Factor Internal Fraud External Fraud Employmen t Practices and Workplace Safety Clients, Products & Business Practices Damage to Physical assets Business Disruption and System Failures Corporate Finance OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Execution Delivery & Process Management Trading and Sales OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Retail Banking OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Commercial Banking OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Paym. & Settlements OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Agency Services OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Asset Management OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Retail Brokerage OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j OpVaR i,j Total Cap. Req., OpVaR i,j Each step of the approach adopted by a bank will be subject to supervisory validation regarding the assumptions used by the bank. MEASUREMENT OF OPERATIONAL RISK ON A BANK OPERATING IN THE TURKISH BANKING SECTOR This part of the study presents a comparison of each approach applied on dataset of a Turkish bank. The Bank is furthermore named as Bank A. In this examination, the capital requirement of this bank is calculated under basic indicator approach, standardised approach and internal measurement approach. BASIC INDICATOR APPROACH (BIA) Basic indicator approach requires banks to allocate 15% of their previous three years average gross income as the capital required for operational risks. In Table 3.1, Bank A s gross income for years 2001, 2002 and 2003 is summarized.

15 Table 3.1: Gross Income of Bank A in 2001, 2002 and 2003 (*1,000 YTL) Items Interest Income 982, , ,607 Interest Expense (807,359) (606,745) (649,802) Net Interest Income 174, , ,805 Non-Interest Income 326, , ,013 Non-Interest Expense (311,395) (410,173) (211,087) Net Non-Interest Income 15, , ,926 + Provisions 6,086 15,696 26,894 - Realised Profits from sale of Securities 40,582 93,685 42,669 + Extraordinary Items Gross Income 155, , ,956 Table 3.2 illustrates the average gross income of the bank over 2001, 2002 and 2003 and the capital required under BIA. Table 3.2: Gross Income Values of Bank A. (*1,000 YTL) Year Gross Income , , ,956 Average Gross Income (AGI) 335,110 Capital Requirement (AGI *0.15) 50,266 The bank s last three years average gross income is 335 million YTL. Therefore, the capital requirement is approximately 50 million YTL. STANDARDISED APPROACH (SA) The standardized approach requires banks to calculate the average gross income values for each business line and multiply these values by various beta (R) factors set by the Basel Committee. Table 3.2 summarizes the capital requirement calculations for Bank A under SA. Hosted by The Berkeley Electronic Press

16 Table 3.2: Capital Requirement of Bank A under Standardised Approach (YTL) Average Beta Capital Business Lines Gross Income Factor Requireme (YTL) (%) nt (YTL) Corporate Finance Trading and Sales 58,670, ,560,618 Retail Banking 100,053, ,006,478 Commercial Banking 176,077, ,411,570 Payments and Settlements 309, ,633 Agency Services Asset Management Retail Brokerage Total Capital Requirement 49,034,305 The adjusted trial balances of Bank A over previous three years are used for the computations of gross incomes of business lines. Each item in the financial statements is allocated to the business lines or excluded from the business lines defined by the Committee. It is observed that Bank A doesn t have any operations in corporate finance, asset management and retail brokerage areas of business. Therefore, the bank is assumed not to incur any operational risk in these business lines. The bank is required to allocate an amount of capital about 10.6 million YTL in trading and sales, 12 million YTL in retail banking, 26.4 million YTL in commercial banking, 56 thousand YTL in payments and settlements. The total capital requirement of the bank is approximately 49 million YTL under SA. INTERNAL MEASUREMENT APPROACH For all AMA models, Basel Committee suggests banks to constitute a matrix of 56 cells consisting of 8 business lines and 7 risk factors. However, the Committee also encourages banks to determine their own risk factors and build their own operational risk matrices. By this means, the operational risk factors of Bank A in this research are detailed and grouped into 12 categories. Human factor is grouped into two as human error (HI) and human fraud (H2); system factor is grouped in two as system development and application risk (S1) and system

17 security risk (S2); processes are grouped in six as payment and delivery risk (P1), documentation risk (P2), internal or external reporting risk (P3), project risk and change management risk (P4), lack of control for physical assets (P5), unidentification of responsibilities and authorities (P6); and finally external factors are grouped in two as political risk (E1) and external fraud and criminal activities (E2). Hence, the operational risk matrix produced for Bank A has 96 cells with 12 risk factors and 8 business lines as illustrated in Table 3.3. Table 3.3: Operational Risk Matrix Produced for Bank A Risk Factor H1 H2 S1 S2 P1 P2 P3 P4 P5 P6 E1 E2 Business Lines Corporate Finance Trading and Sales Retail Banking Commercial Banking Payments and Settlements Agency Services Asset Management Retail Brokerage In part 2.3, each step for calculating required capital is explained. In this part of the study, these steps will be applied on Bank A s internal data. Step 1: Calculating gross income of each business line. The gross income values calculated in standardised approach are used (Table 3.2). Step 2: Calculating PE i,j and LGE i,j parameters. As illustrated in formula 2.2; PE is the ratio of number of transactions completed with operational risk to business line s annual transaction volume. Table 3.4 illustrates number of transactions in each business line and Table 3.5 puts forward the PE estimates of the bank. Hosted by The Berkeley Electronic Press

18 Tablo 3.4: Number of Transactions Completed with Operational Risk in Each Business Line /Risk Factor Category(Np) and Business Line Annual Transaction Volume (Transaction numbers rounded) Risk Factor Human Process System External Factors H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Business Line Annual Transaction Volume Business Line Corporate Finance Trading and Sales 3,200,000 5,000 1,200, ,000 12,000 70,000 3,600 2,200 75,000 50,000 2, ,000 17,000,000 Retail Banking 2,700,000 2, ,000 10, ,000 2, ,000 10,000 1, ,000,000 Commercial Banking 870,000 6,000 7, , ,000 8, ,000 27,000 18,000 9,600 8,000,000 Paym. & Settlements 25,000,000 5,000 2,500 5,200 2, , , , , , ,000,000 Agency Services 5,000 2, , , , ,000 Asset Management Retail Brokerage Tablo 3.5: Probability of Loss Events (PEs) Human Process System External Factors Risk Factor Business H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Line Corporate Finance Trading and Sales Retail Banking Commercial Banking Paym. & Settlements Agency Services Asset Management Retail Brokerage

19 By conducting an inhouse research with internal control, audit and operational risk departments and managers and employees in charge of the bank, LGE parameters are forecasted and illustrated in Table 3.6. Tablo 3.6: Forecasted LGEs of Bank A Risk Factor H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Business Lines Corporate Finance Trading and Sales Retail Banking Commercial Banking Payments and Settlements Agency Services Asset Management Retail Brokerage Step 3: Expected loss of the bank is generated by the multiplication of gross income of each business line with PE and LGE as illustrated in formula 2.4 of the study. EL i,j = EI i * PE i,j * LGE i,j (2.4) The amount of expected losses of Bank A is exhibited in Table 3.7. Tablo 3.7: Expected Losses of Bank A (YTL) Human Process System External Factors Risk Factor H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Business Line Corp Fin Trad. and Sal. 4,472,179 10, , ,631 18,634 21,739 6,708 3,074 23,292 93,170 4, ,284 Ret. Bank. 2,431,011 5, ,102,958 4, , ,123 22,509 2,250 0 Com. Bank. 1,723,141 35,651 15,448 1,703, ,822 17, ,513, , ,256 38,027 Paym. & Settl. 13, , , Agen. Services Asset Manag Ret. Brok Total 8,640,239 51, ,131 3,588,932 23, ,993 24,840 3,075 1,833, , , ,800 Hosted by The Berkeley Electronic Press

20 Step 4: Calculating the amount of unexpected losses of the bank. As explained in part 3.3.1, the bank is required to calculate a gamma factor and multiply with the amount of expected losses to obtain the amount of unexpected losses. Formula 2.6 for gamma factor is used under the assumption of the bank s loss distribution is standard normal for each business line/risk factor. ki, j Gamma = (2.6) Np where k is the multiplier, Np is the number of operational risk events occured in a period of time. The table value of k at 99.9% confidence level is The Np values are given in Table 3.4. The generated gamma factors are illustrated in Table 3.8. i, j Table 3.8: Gamma Factors of Bank A Business Lines Risk Factor H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Corporate Finance Trading and Sales Retail Banking , Commercial Banking Payments and Settlements Agency Services Asset Management Retail Brokerage Next, gamma factors are used to compute the unexpected losses (UL) of the bank. For calculating the unexpected losses, each gamma factor is multiplied by the expected losses (EL) of each business line/risk factor in Table 3.7. The amount of unexpected losses of the Bank is presented in Table

21 Table 3.9: Unexpected Losses of Bank A (YTL) Risk Factor H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Business Line Corporate Finance Trading and Sales 7, ,054 3, , Retail Banking 4, , , , Commercial Banking 5,726 1, , , ,589 2,017 4,118 1,203 Payments and Settlements Agency Services ,140 0 Asset Management Retail Brokerage The total required capital for operational risks is the sum of the expected and unexpected losses of the bank. Table 3.10 illustrates the required capital of Bank A calculated under internal measurement approach. Table 3.10: Capital Requirement of Bank A under IMA (YTL) Risk Factor Business Line H1 H2 P1 P2 P3 P4 P5 P6 S1 S2 E1 E2 Capital Required Corporate Fin ,479,93 Trad. and Sales 10, , ,375 19,161 21,994 7,055 3,278 23,556 94,462 4, ,247 5,980, ,435,59 Retail Bank ,107,045 4, , ,727 23,207 2, ,168, ,728,86 Comm. Bank. 37,078 15,991 1,716, ,339 17, ,520, , ,375 39,231 5,695,512 9 Paym. and Sett. 13, , ,059 Agen. Serv Asset Mng Retail Brok ,658,31 Cap. Req. 53, ,728 3,609,495 23, ,345 25,822 3,278 1,843, , , ,969 15,860,347 1 Total Cap. Req. 15,860,347 Finally Bank A is required to allocate a capital of 16.5 million YTL under IMA. The required risk based capital under each approach is summarised in Table Hosted by The Berkeley Electronic Press

22 Table 3.11: Required Capital Calculated Using Each Approach Capital Required Approach Used ( Million YTL) Basic Indicator Approach 50.3 Standardised Approach 49 Internal Measurement Approach 15.9 If the bank uses basic indicator or standardised approach for operational risk measurement, it will have to allocate more capital than the bank would actually need. The fundamental advantage for a bank using IMA is the bank s capability of identifying, measuring and managing its operational risks effectively. Banks using IMA will be able to demonstrate in which business lines high operational risks is incurred and which operational factors banks face at most. All calculations made with Bank A s internal data put forward the fact that this bank incurs the highest level of operational risk in human error (H1) factor. Furthermore, trade and sales and commercial banking business lines are also exposed to significant amount of operational losses. CONCLUSION The Basel Committee proposes three approaches for quantification of operational risk from simple to more complicated and refined. Basic indicator approach, the simplest model, bases the amount of operational risk bank incurs on a fixed percentage (alpha-b) of its average gross income. Standardised approach also bases the quantification of operational risk on average gross income but sets various percentages (betas -R) for each of the predefined eight business lines. The first two approaches actually suggest that two banks with equal gross income incur about the same amount of operational risk. However operational risk is closely related with the transaction volume of banks. Hence, the amount of gross income may not be a good indicator to be used in measuring operational risk since it does not take into account the transaction volume. Accordingly, basic indicator approach and standardised approach may be viewed as insufficient in measuring operational risk. Furthermore in the first two approaches, banks are unable to demonstrate what risk factors they face in operational risk and are incapable of setting an operational risk management culture. Advanced Measurement Approach (AMA) supposedly is the most sophisticated model that enables banks to figure out the operational risk factors they incur. Internal Measurement Approach (IMA) is one of the models under AMA. The Committee has proposed a series of business lines and seven loss categories as a means by which banks may collect the full scope of operational

23 risk loss event data and prepare their operational risk matrix. This matrix is announced to be used in IMA model to figure out the weaknesses of banks in operational risk management framework. However, banks are free to determine their operational loss categories to be used in the operational risk matrix. Banks using IMA are expected to succeed in determining the operations resulting to operational risk and capable of demonstrating the progress in their operational risk management procedure. Thus, IMA is strongly recommended by Basel Committee because of its higher level of sensitivity in risk measurement and success of risk management. However, a bank is ought to prove the supervisor the sufficiency of its loss database used in IMA. Furthermore, banks like to use IMA may need to make additional investments in setting an operational risk management system. REFERENCES Alexander C. (2001). Understanding the Internal Measurement Approach to Assessing Operational Risk Capital Charges, ISMA Center Discussion Papers In Finance, Basel Committee on Banking Supervision (2004). International Convergence of Capital Measurement and Capital Standards: A Revised Framework (Basel II). Basel Committee on Banking, Supervision (2003). Sound Practices for the Management and Supervision of Operational Risk Basel Committee on Banking Supervision. (2003)."Consultative Document, The New Basel Capital Accord". Basel Committee on Banking Supervision. (2001). "Consultative Document, Operational Risk Supporting Document. Brink, G.V.D. (2002). Operational Risk : The New Challenge for Banks, Palgrave, p.9. Leon, B. and Galloway, D. (2000) "Managing Operational Risk through Cultural Changes: International Financial Markets: Prices and Policies", Mc Graw - Hill; International Edition. Hosted by The Berkeley Electronic Press

24 Marshall, C.L. (2001). Measuring and Managing Operational Risks in Financial Institutions: Tools, Techniques and Other Resources, John Wiley and Sons,2, p.57. Pezier, J. and Alexander, C.(2001). Binomial Gammas Operational Risk Magazine, April Issue. Pennathur A.K. (2001). E-risk management for banks in the age of the internet ; Journal of Banking and Finance, v25 issue 11. Porter, D. (2003). Insider Fraud: Spotting The Wolf in Sheep s Clothing ; Computer Fraud and Security, v. 2003, Issue 4, pg