Galileo Galilei wrote: "Enumerate what is numerable. Measure what is measurable and make measurable what is not measurable."
Galileo's words are relevant to the quantification of operational risk. This is a challenging and evolving area of risk management. It is the subject of intense debate regarding approaches, emphasis and applications. The outcomes can affect a firm's strategy, product pricing, compensation practices and capital usage.
Defining Operational Risk
In the broadest sense, operational risk encompasses problems other than credit and market risk. Its key components are problems relating people, processes, technology and exposure to external events. They can cause huge financial losses and reputational damage. They can also swiftly destroy an otherwise successful franchise. Operational risk exists in all sectors of financial services, including trading, corporate finance, investment management and retail banking.
Relevance To Derivatives
Operational risks have been common problems in the over-the-counter derivatives markets. These risks have occurred in all parts of organizations and during all phases of the transactional process. Some of the most significant operational risk losses have resided on trading desks. These have included "rogue trading," incorrect valuation of transactions and inappropriate selling practices. Operational risks have also arisen in transaction booking, confirmations, accounting, margin and settlement. Some factors and causes of problems have been inadequate oversight, poor training, product complexity and manual processes.
Goals of Quantification
Quantification seeks to answer the fundamental question, "How much can you lose from operational risk?" The idea is to estimate such amounts under specified conditions, time horizons and probabilities. The basis for such estimates are either historical or simulated experience. Extreme events and circumstances warrant particular attention.
Quantification can also help firms obtain a more rigorous understanding of other related issues, including: (i) the distribution of operational risk losses (ii) the amounts of capital a firm should maintain to satisfy regulatory requirements and to address its risk profile (iii) the actual returns on capital, taking into account all applicable risks (iv) appropriate prices for products and (v) optimal levels of investment in people, processes and technology.
Such information can further inform key decisions such as: (i) the timing of additional capital raising (ii) whether to exit, maintain or enter markets (iii) the focus of risk mitigation (iv) compensation levels for employees and (v) whether to retain or transfer risks.
Other related aspects of operational risk quantification are risk indicators, analysis of loss experience and the scoring of qualitative risk assessments.
Proposed Capital Regulations
TheBasel Committee on Banking Supervision has proposed that banks reserve regulatory capital specifically for operational risk. This capital requirement can be calculated using various methods of increased complexity and corresponding potential for reduced capital requirements. As a result, derivatives sales and trading units may require larger amounts of regulatory capital than before, although such proposition will need to be validated by each firm's actual experience under the final version of the capital requirements. The cost of this additional capital, if allocated to individual business units, may affect the profitability of a derivatives unit, its returns on capital and compensation of employees. The proposed regulation continues to be heavily debated among the Basel Committee, local banking regulators, banks and other industry participants.
Key Challenges
Quantification of operational risk raises various challenges.
1 The worst operational risk losses occur infrequently, but are
large and devastating. Firms often don't recognize the full
extent of these operational risks until it is too late.
2 Firms often lack the necessary data and collection process.
3 Historical losses resulting from operational risk may have
been incorrectly classified as credit and market risks.
4 Operational risk is often specific to an organization and can
vary depending on a firm's product mix, experience of staff
and quality of systems.
Enhancing Quantification
Quantification initiatives are susceptible to struggle or failure if they are generic or "off the shelf." Such initiatives should be adapted to the specific circumstances, culture and characteristics of an organization. Problems can also arise if the requirements of the program exceed the resources or capability of an organization. Data inputs should also be made as simple as possible. Managers of business units should understand the assumptions of the approach and the actions needed to lower a unit's operational risk exposure or capital allocations. Above all, quantification efforts should lead to action.
There is no clear consensus in the industry regarding the appropriate emphasis for quantification as part of an overall operational risk effort. Most agree, however, that quantification tools will be far more effective than otherwise if they complement other key elements of operational risk management. This includes a clear vision, customized definition, risk limits, assessment, risk transfer, a strong team and excellent technology.
Key Questions
Certain fundamental questions are relevant to the quantification of operational risk. These same questions are also relevant to credit and market risk, but may assume greater importance or require different emphasis for operational risk. For example:
1 What definition of operational risk should be used
for measurement?
2 What is the expected time period associated with the
measurement? Is it daily, weekly, monthly or annually?
3 What confidence level is appropriate?
4 What is the right balance between objective and
subjective data?
5 How can external industry loss data best complement a
firm's own loss data?
6 What assumptions should be made in the absence of
observable data?
7 How can data outliers be differentiated from meaningful
patterns?
These and related questions can benefit from further examination by regulators and industry participants.
Approaches
Various approaches to quantification are now under discussion or in use. This is a rich area for further development. As yet, no single method has emerged as preferred or dominant, and existing approaches are undergoing refinement in light of industry practice and discussion.
Some proposed calculations are based on broad measures such as size, earnings, gross income and related variables. Others are based on more specific measures within each business line such as transaction volume, gross income, assets under management and others. The simplest approach can rely upon a single variable; others examine the relationships among multiple variables. Certain approaches examine a firm's own loss frequency and severity to arrive at a total loss estimate. Various statistical, actuarial and mathematical techniques are also employed.
Under some approaches, future estimates of losses are a function of the actual or expected loss experience. In others, such estimates are derived from known statistical distributions which are selected based on observed losses. Alternatively, qualitative factors are used to adjust calculated numbers. Often a variety of approaches, rather than a single approach, can offer the best outcomes.
Limits To Quantification
The quantification of operational risk is a combination of methodology and judgment, with judgment now occupying a far more important role than in the case of market and credit risk. There is much yet to understand about operational risk. Additional data needs to be collected and analyzed. Modeling approaches used in market and credit risk can be helpful for comparison, but must be adapted. The results from models should be viewed as starting points and guides to overall direction and magnitude of operational risk rather than as precise measures. Firms should be wary of strict reliance on the outcomes of models. Common sense, institutional knowledge and experience of employees are also critical.
Conclusion
Quantification can help improve our understanding of operational risk. It also can improve the way organization are managed and evaluated. So, as students of Galileo, let us proceed. There is much exciting and challenging work ahead. Numera ciò che è numerabile. Misura ciò che è misurabile e ciò che non è misurabile rendilo misurabile.
This week's Learning Curve is by Charles Fishkin, a member of the board of directors of the International Association of Financial Engineersand its operational risk committee. He thanks Emilio Barone, Penny Cagan, Michael Haubenstock, David Syerand others unnamed for their comments.
