Operational risk
Encyclopedia
An operational risk is, as the name suggests, a risk arising from execution of a company's business functions. It is a very broad concept which focuses on the risks arising from the people, systems and processes through which a company operates. It also includes other categories such as fraud
risks, legal risk
s, physical or environmental risks.
A widely used definition of operational risk is the one contained in the Basel II
http://www.bis.org/publ/bcbsca.html regulations. This definition states that operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
The approach to managing operational risk differs from that applied to other types of risk, because it is not used to generate profit. In contrast, credit risk
is exploited by lending institutions to create profit, market risk
is exploited by traders and fund managers, and insurance risk is exploited by insurers. They all however manage operational risk to keep losses within their risk appetite - the amount of risk they are prepared to accept in pursuit of their objectives. What this means in practical terms is that organisations accept that their people, processes and systems are imperfect, and that losses will arise from errors and ineffective operations. The size of the loss they are prepared to accept, because the cost of correcting the errors or improving the systems is disproportionate to the benefit they will receive, determines their appetite for operational risk.
Determining appetite for operational risk is a discipline which is still in its infancy. Some of the issues and considerations around this process are outlined in this Sound Practice paper published by the Institute for Operational Risk in December 2009.http://www.ior-institute.org/dmdocuments/RiskAppetiteSPGVersion1.pdf
Globalization
and deregulation
in financial markets, combined with increased sophistication in financial technology, have introduced more complexities into the activities of banks and therefore their risk profiles. These reasons underscore banks' and supervisors' growing focus upon the identification and measurement of operational risk.
Events such as the September 11 terrorist attacks, rogue trading losses at Société Générale
, Barings, AIB
and National Australia Bank
serve to highlight the fact that the scope of risk management
extends beyond merely market
and credit risk
.
The list of risks (and, more importantly, the scale of these risks) faced by banks today includes fraud, system failures, terrorism and employee compensation claims. These types of risk are generally classified under the term 'operational risk'.
The identification and measurement of operational risk is a real and live issue for modern-day banks, particularly since the decision by the Basel Committee on Banking Supervision
(BCBS) to introduce a capital charge for this risk as part of the new capital adequacy framework (Basel II
).
"The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events."
However, the Basel Committee recognizes that operational risk is a term that has a variety of meanings and therefore, for internal purposes, banks are permitted to adopt their own definitions of operational risk, provided that the minimum elements in the Committee's definition are included.
Other risk terms are seen as potential consequences of operational risk events. For example, reputational risk
(damage to an organization through loss of its reputation or standing) can arise as a consequence (or impact) of operational failures - as well as from other events.
By contrast it is relatively difficult to identify or assess levels of operational risk and its many sources. Historically organizations have accepted operational risk as an unavoidable cost of doing business. Many now though collect data on operational losses - for example through system failure or fraud - and are using this data to model operational risk and to calculate a capital reserve against future operational losses. In addition to the Basel II requirement for banks, this is now a requirement for European insurance firms who are in the process of implementing Solvency II http://ec.europa.eu/internal_market/insurance/solvency/index_en.htm, the equivalent of Basel II for the banking sector.
The Operational Risk Management framework should include identification, measurement, monitoring, reporting, control and mitigation frameworks for Operational Risk.
Fraud
In criminal law, a fraud is an intentional deception made for personal gain or to damage another individual; the related adjective is fraudulent. The specific legal definition varies by legal jurisdiction. Fraud is a crime, and also a civil law violation...
risks, legal risk
Legal risk
Legal risk is risks that counterparty are not legally able to enter into a contract. Another legal risk relates to regulatory risk, i.e., that a transaction could conflict with a regulator's policy or, more generally, that legislation might change during the life of a financial contract.-The Risk...
s, physical or environmental risks.
A widely used definition of operational risk is the one contained in the Basel II
Basel II
Basel II is the second of the Basel Accords, which are recommendations on banking laws and regulations issued by the Basel Committee on Banking Supervision...
http://www.bis.org/publ/bcbsca.html regulations. This definition states that operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
The approach to managing operational risk differs from that applied to other types of risk, because it is not used to generate profit. In contrast, credit risk
Credit risk
Credit risk is an investor's risk of loss arising from a borrower who does not make payments as promised. Such an event is called a default. Other terms for credit risk are default risk and counterparty risk....
is exploited by lending institutions to create profit, market risk
Market risk
Market risk is the risk that the value of a portfolio, either an investment portfolio or a trading portfolio, will decrease due to the change in value of the market risk factors. The four standard market risk factors are stock prices, interest rates, foreign exchange rates, and commodity prices...
is exploited by traders and fund managers, and insurance risk is exploited by insurers. They all however manage operational risk to keep losses within their risk appetite - the amount of risk they are prepared to accept in pursuit of their objectives. What this means in practical terms is that organisations accept that their people, processes and systems are imperfect, and that losses will arise from errors and ineffective operations. The size of the loss they are prepared to accept, because the cost of correcting the errors or improving the systems is disproportionate to the benefit they will receive, determines their appetite for operational risk.
Determining appetite for operational risk is a discipline which is still in its infancy. Some of the issues and considerations around this process are outlined in this Sound Practice paper published by the Institute for Operational Risk in December 2009.http://www.ior-institute.org/dmdocuments/RiskAppetiteSPGVersion1.pdf
Background
Since the mid-1990s, the topics of market risk and credit risk have been the subject of much debate and research, with the result that financial institutions have made significant progress in the identification, measurement and management of both these forms of risk. However, it is worth mentioning that the near collapse of the U.S. financial system in September 2008 is a clear indication that our ability to measure market and credit risk is far from perfect.Globalization
Globalization
Globalization refers to the increasingly global relationships of culture, people and economic activity. Most often, it refers to economics: the global distribution of the production of goods and services, through reduction of barriers to international trade such as tariffs, export fees, and import...
and deregulation
Deregulation
Deregulation is the removal or simplification of government rules and regulations that constrain the operation of market forces.Deregulation is the removal or simplification of government rules and regulations that constrain the operation of market forces.Deregulation is the removal or...
in financial markets, combined with increased sophistication in financial technology, have introduced more complexities into the activities of banks and therefore their risk profiles. These reasons underscore banks' and supervisors' growing focus upon the identification and measurement of operational risk.
Events such as the September 11 terrorist attacks, rogue trading losses at Société Générale
Société Générale
Société Générale S.A. is a large European Bank and a major Financial Services company that has a substantial global presence. Its registered office is on Boulevard Haussmann in the 9th arrondissement of Paris, while its head office is in the Tours Société Générale in the business district of La...
, Barings, AIB
Allied Irish Banks
Allied Irish Banks p.l.c. is a major commercial bank based in Ireland.AIB is one of the so called "big four" commercial banks in the state. The bank has one of the largest branch networks in Ireland; only Bank of Ireland fully rivals it. AIB offers a full range of personal and corporate banking...
and National Australia Bank
National Australia Bank
National Australia Bank is one of the four largest financial institutions in Australia in terms of market capitalisation and customers. NAB is ranked 17th largest bank in the world measured by market capitalisation...
serve to highlight the fact that the scope of risk management
Risk management
Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities...
extends beyond merely market
Market risk
Market risk is the risk that the value of a portfolio, either an investment portfolio or a trading portfolio, will decrease due to the change in value of the market risk factors. The four standard market risk factors are stock prices, interest rates, foreign exchange rates, and commodity prices...
and credit risk
Credit risk
Credit risk is an investor's risk of loss arising from a borrower who does not make payments as promised. Such an event is called a default. Other terms for credit risk are default risk and counterparty risk....
.
The list of risks (and, more importantly, the scale of these risks) faced by banks today includes fraud, system failures, terrorism and employee compensation claims. These types of risk are generally classified under the term 'operational risk'.
The identification and measurement of operational risk is a real and live issue for modern-day banks, particularly since the decision by the Basel Committee on Banking Supervision
Basel Committee on Banking Supervision
The Basel Committee on Banking Supervision is a committee of banking supervisory authorities that was established by the central bank governors of the Group of Ten countries in 1975. It provides a forum for regular cooperation on banking supervisory matters. Its objective is to enhance...
(BCBS) to introduce a capital charge for this risk as part of the new capital adequacy framework (Basel II
Basel II
Basel II is the second of the Basel Accords, which are recommendations on banking laws and regulations issued by the Basel Committee on Banking Supervision...
).
Definition
The Basel Committee defines operational risk as:"The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events."
However, the Basel Committee recognizes that operational risk is a term that has a variety of meanings and therefore, for internal purposes, banks are permitted to adopt their own definitions of operational risk, provided that the minimum elements in the Committee's definition are included.
Scope exclusions
The Basel II definition of operational risk excludes, for example, strategic risk - the risk of a loss arising from a poor strategic business decision.Other risk terms are seen as potential consequences of operational risk events. For example, reputational risk
Reputational risk
Reputational risk, often called reputation risk, is a type of risk related to the trustworthiness of business. Damage to a firm's reputation can result in lost revenue or destruction of shareholder value, even if the company is not found guilty of a crime...
(damage to an organization through loss of its reputation or standing) can arise as a consequence (or impact) of operational failures - as well as from other events.
Basel II event type categories
The following lists the official Basel II defined event types with some examples for each category:- Internal Fraud - misappropriation of assets, tax evasion, intentional mismarking of positions, briberyBriberyBribery, a form of corruption, is an act implying money or gift giving that alters the behavior of the recipient. Bribery constitutes a crime and is defined by Black's Law Dictionary as the offering, giving, receiving, or soliciting of any item of value to influence the actions of an official or...
- External Fraud- theft of information, hacking damage, third-party theft and forgery
- Employment Practices and Workplace Safety - discrimination, workers compensation, employee health and safety
- Clients, Products, & Business Practice- market manipulation, antitrust, improper trade, product defects, fiduciary breaches, account churning
- Damage to Physical Assets - natural disasters, terrorism, vandalism
- Business Disruption & Systems Failures - utility disruptions, software failures, hardware failures
- Execution, Delivery, & Process Management - data entry errors, accounting errors, failed mandatory reporting, negligent loss of client assets
Difficulties
It is relatively straightforward for an organization to set and observe specific, measurable levels of market risk and credit risk because models exist which attempt to predict the potential impact of market movements, or changes in the cost of credit. It should be noted however that these models are only as good as the underlying assumptions, and a large part of the recent financial crisis arose because the valuations generated by these models for particular types of investments were based on incorrect assumptions.By contrast it is relatively difficult to identify or assess levels of operational risk and its many sources. Historically organizations have accepted operational risk as an unavoidable cost of doing business. Many now though collect data on operational losses - for example through system failure or fraud - and are using this data to model operational risk and to calculate a capital reserve against future operational losses. In addition to the Basel II requirement for banks, this is now a requirement for European insurance firms who are in the process of implementing Solvency II http://ec.europa.eu/internal_market/insurance/solvency/index_en.htm, the equivalent of Basel II for the banking sector.
Methods of operational risk management
Basel II and various Supervisory bodies of the countries have prescribed various soundness standards for Operational Risk Management for Banks and similar Financial Institutions. To complement these standards, Basel II has given guidance to 3 broad methods of Capital calculation for Operational Risk- Basic Indicator ApproachBasic indicator approachThe basic approach or basic indicator approach is a set of operational risk measurement techniques proposed under Basel II capital adequacy rules for banking institutions....
- based on annual revenue of the Financial Institution - Standardized ApproachStandardized approach (operational risk)In the context of operational risk, the standardized approach or standardised approach is a set of operational risk measurement techniques proposed under Basel II capital adequacy rules for banking institutions....
- based on annual revenue of each of the broad business lines of the Financial Institution - Advanced Measurement ApproachesAdvanced measurement approachUnder Basel II, operational risk charges can be calculated by using one of the three methods that increase in sophistication and risk sensitivity: the Basic Indicator Approach; the Standardised Approach; and Advanced Measurement Approaches .Under AMA the banks are allowed to develop their own...
- based on the internally developed risk measurement framework of the bank adhering to the standards prescribed (methods include IMA, LDA, Scenario-based, Scorecard etc.)
The Operational Risk Management framework should include identification, measurement, monitoring, reporting, control and mitigation frameworks for Operational Risk.
See also
- Risk managementRisk managementRisk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities...
- Operational risk managementOperational risk managementThe term Operational Risk Management is defined as a continual cyclic process which includes risk assessment, risk decision making, and implementation of risk controls, which results in acceptance, mitigation, or avoidance of risk...
- Risk modelingRisk modelingFor risk modeling in general see risk modelingFinancial risk modeling refers to the use of formal econometric techniques to determine the aggregate risk in a financial portfolio...
- VolatilityVolatility (finance)In finance, volatility is a measure for variation of price of a financial instrument over time. Historic volatility is derived from time series of past market prices...
- Key risk indicatorKey Risk IndicatorA Key Risk Indicator, also known as a KRI, is a measure used in management to indicate how risky an activity is. It differs from a Key Performance Indicator in that the latter is meant as a measure of how well something is being done while the former is an indicator of the possibility of future...
s
External links
- Operational Risk in the Basel ii framework
- The Institute of Operational Risk The institute provides professional recognition and enables members to maintain competency in the discipline of operational risk.
- OpRisk & Regulation is the home page of the leading educational resource on operational risk, including a magazine, training, conferences, books, etc.
- Revised international capital framework is the text of the new Basel II Accord.
- Operational Risk Blog is a resource for operational risk content.
- Strategic risk index is an index quantifying the level of strategic risk in markets around the world.
- Constraints of Consistent Operational Risk Measurement and Regulation: Data Collection and Loss Reporting, Andreas A. Jobst, 2007 (Journal of Financial Regulation and Compliance)
- The Credit Crisis and Operational Risk - Implications for Practitioners and Regulators, Andreas A. Jobst, 2010 (Journal of Operational Risk, Vol. 5, No. 2)
- The Risk Management Association - leading industry organization for operational risk professionals
- http://bis2information.org: Practical articles, on BIS2 and risk modeling, submitted by professionals to help create an industry standard.
- http://www.bos.frb.org/economic/wp/wp2006/wp0613.htm FRB Boston paper on measurement of operational risk.
- Operational Risk - The Sting is Still in the Tail But the Poison Depends on the Dose, Andreas A. Jobst, 2007 (Journal of Operational Risk)
- Convergence of Operational and Credit Risk, Tyson Macaulay 2008
- Operational Continuity and Additivity of Operational Risk, Tyson Macaulay 2008
- Metrics and Operational Continuity, Tyson Macaulay 2008
- Operational Risk Consortium is a consortium that collects and analyzes operational risk loss data for the insurance industry.