Madrid v0.2

The Management Consultants.
CHALLENGES IN THE QUANTIFICATION OF

OPERATIONAL RISK
RiskLab-Madrid
Madrid, 14. November 2002
IBM Unternehmensberatung GmbH

This report is solely for the use of the client personnel. No part of it may be circulated, quoted, or reproduced for distribution outside the client organization without prior written approval from IBM Unternehmensberatung GmbH.
Agenda
1 2 3 4 5
Quantification issues in operational risk management Prototype of an operational risk VaR calculation engine Operational Risk and Outsourcing Operational Risk and Project-/Portfolio Management Critical success factors for Operational Risk Management
Agenda
1 2 3 4 5
Quantification issues from a practitioners view Prototype of an operational risk VaR calculation engine Operational Risk and Outsourcing Operational Risk and Project-/Portfolio Management Critical success factors for Operational Risk Management
2 Basic questions
Senior Management would much easier acknowledge the high value of operational risk management, if one could deliver quantifications in the following areas:
Relevant questions:
Can you help finding an efficient project portfolio? Can you support the business case of projects? Can you help assuring and afterwards assess the success of a project? Can you help in outsourcing decisions and implementations?
2002
Risikomanagement-Vorstand-20021105.ppt
Seite 4
The smallest part of the effort to build and run an operational risk management is the developpment of VaR calculation models and engines.
Identify
Identify and describe all potential process risks
Track
Find means to track risks
Measure
Assess the importance of the risk - Risk probability - Risk impact
Manage
Integrate Oprisk exposure data in managment process Manage Oprisk exposure(e.g. insurance)
Create report mechanism
Data Collection
Prioritisation of risks
Develop and continuous refinement of VaR calculation models
75%
5%
20%
2002
Seite 5
Agenda
1 2 3 4 5
The core functionality of the operational risk VaR calculation is realized in routines for testing and demonstration
Core Data Internal Loss Data External Loss Data Public Loss Data Rating from KRI Rating from contr. Assess.
Calculation Parameter Estimation: Severity Distribution Parameter Estimation: Insurance Distribution Parameter Estimation: Frequency Distribution
Supporting Data Insurance Data Scaling Factors
Monte-Carlo Engine
Loss Distribution
VaR with Insurance
VaR without Insurance Results
Marginal VaR
VaR goodness check
2002
Seite 7
Severity Distribution
The severity parameter estimation is the most sensitive part of the parameter estimation and a method toolbox has to be available to cover different data types and availability condition .
Methods devised and prototyped: Maximum likelihood (MLE) fit to internal data 6 different distribution types Weibull Burr Expontential Lognormal Pareto Gen. Pareto Minimum least square fit to data in histogram form Mixing of internal with external data Integrated MLE Sequential MLE for equal or similar internal and external data Loss events series reconstruction from histograms (new method) Extreme Value Theory / Peaks over Thresholds
2002
Seite 8
Frequncy Distribution
The estimation of the expected number of loss events will be done from the internal loss history, self assessment, key risk indicators and gross exposure indicators.
Methods devised: Allow different distribution to account for different standard deviations of the frequency distribution Integrate the following data sources Internal loss history exposure indicators self assessments key risk indicators Mathematical tools Maximum likelihood estimator Neural or Bayesian networks Time series filter tools
2002
Seite 9
Monte-Carlo Engine
Based on the currently available loss data the Monte Carlo calculation calculates an expected loss of x and a Value at Risk of y. Distribution of aggregated losses
0,5 0,4 probability 0,3 0,2 0,1 0

24 10 16 32 64 2 4 8 12 25 51 20 48 8 6 2
Expected loss VaR
Aggregated loss
2002
Seite 10
Agenda
1 2 3 4 5
2 Basic questions
The Business Case of outsourcing is strongly influenced by operational risk capital savings.
Quantification issues in the context of outsourcing Operational VaR before outsourcing Operational VaR after outsourcing Risk Transfer Pricing Pricing of penalties within Service Level Agreements SLA
Financial Institution
SLA SLA
e.g. Payment Systems
e.g. Securities settlement
e.g. IT Infrastructure AMS
Examples for Outsourcing Areas of a Financial Institution
2002
Seite 12
What are Service Level Agreements
Definition A Service Level Agreement includes an obligation between a customer and a provider (external or internal) to support the needs of the customer to a defined level.
Benefits Better/clearer communication between customer and provider Predictability of amount of service Consolidation of required services. Achievement of a consistent level of quality Guarantee that availability and performance of technical solutions satisfy business side demands.
2002
Seite 13
2 Basic questions
There are a range of important questions relevant for Service Level Agreements
Relevant questions How are Service Level Agreements (SLAs) incorporated into the existing contracts with banks. How homogeneous are the existing contracts To what extent are risk relevant issues integrated into the current SLAs? Can the existing SLAs be modified and/or adapted? Are the banks willing to pay for the new service? Or must the services be offered free in order to remain in the market? What possible pricing structures are available? How do you price penalties? In the case that the operational risk is passed on to a third party, what are the results? How should SLAs with a third party look like?
2002
Seite 14
Risk transfer can only be achieved after a series of steps

Selection of the relevant processes Not every process hides a relevant operational risk Clear documentation of processes Particularly important are the interfaces and the transfer of responsiblity Formalisation of criteria of measuring service Criteria should not only be meaningful, but also measurable Establishment of a contolling/reporting system The content of the SLA should be continuously monitored Appropriate penalties agreed Risks should be measured in terms of proability and costs. Each possible outrage should be formally documented One component of this is the financial cost of an outrage (with reference to expert knowledge) The penalties should be agreed and become part of the SLA Regular control cycle SLAs should be regularly reconciled with business requirements
Example
2002
Seite 15
Service Level Agreements require regular tuning, otherwise, over the longterm, there is the risk that supply and demand diverge from one another.
Compare requirement and services Define SLAs Werte definieren Agree measurable levels of services which can be guaranteed to the customer.
Identify customer requirements Identify new requirements and services
Proposal of SLAs Prepare SLAs for discusion
SLA control cycle
Modify SLA
Monitor SLAs Levels of service are measured against agreed criteria.
Agreement with client SLAs agreed with customers
The SLA controlling cycle ensures a continual improvement of the levels of service and and a regular integration of new customer requirements (and also elimination of no-longer-necessary services)
2002
Seite 16
The identification, assessment and consolidation of operational risks, together with effective communications between the Operational Risk Managment (ORM) and the Line of Business (LoB) is the purpose of the risk mapping process. Beispiel
The operational risk process is initially driven by the risk mapping workshop. Here a group of experts identify and document all the relevant risks
Planning and Methodology for risk mapping workshops
Communication between lines of business
Introduction of Results of workshop into live environment
Documentation of results
Reporting
2002
Seite 17
How can the operational risks of outsourcing be minimised? By the introduction of an appropriately prophylactic process
Analyse risks
Quantify risks
Manage risks
Monitor risks
The introduction process is classic risk managment:

Analyse risks Risks are identified as the result of a systematic analysis Quantify risks The potential costs of identified risks can be assessed. Manage risks There are a range of possibilities, from internal risk mangement to risk transfer to a third party (insurance). Monitor risks The set of potential risks should be continuously monitored both to assess the efficiency of the risk management regime, and to ensure that new risks are analysed and taken up as soon as they appear.
2002
Seite 18
Agenda
1 2 3 4 5
The introduction of operational risk managment factors into management decisions not only allows investment to be better managed, but also savings in over-secure areas.
Presentation of risks at the level of the company or business unit. Identify acceptable risks Aggregation per business area, process step, or risk category Focussed risk reduction and focussed acceptance of higher risks (taking into account control measures, reduced availability etc.) Efficient mangement of of investments Finally: limiting of cumulative risk (capital reserves)
high
Size of loss
medium
low
low
medium probability
high
Risk acceptance-boundary (for single risks) #

2002
Risk estimate for an area (risk category,, business area, etc.)

Seite 20
Infrastructure projects are often justified by the reduction of operational risk. However in order to be able to calculate a break even of such an investment you need to be able to quantify operational risk.
Top Down view
Estimated savings on capital reserves as a result of reduction of operational risks* Tier I + II reserves ABC-Bank Of which operational risk component Capital reserves for operational risks Of which percent for operational risk in treasury business Capital reserves for operational risks in treasury business Of which savings as a result of new goal architecture (conservative estimate) Interest on capital reserves Resulting savings on reserves costs as a result of new architecture In M
Bottom Up view
Examples from the banking world of losses stemming from problems in operations
8.000 15% 1.200 25% 300 15% 6,25% p.a. Medium sized loss/common event Errors in position reporting as a result of inadequate processes: Loss ca 0,8 Mio Euro, occurrence ca. 10/Yr. false management of turnover as a result of inadequate processes: Loss ca 0,05 Mio Euro, occurance ca. 1/day Daiwa Bank (large loss/rare event) Criminal cover-up of $1.1 billion of trading losses. Regulatory fines $ 340 million (1984-1995) Allied Irish Bank (large loss/rare event) Fraud in treasury department of US-daughter firm Allfirst cost the group $750M (2001).
2,8 p.a.
* Extracted from Quantitative Impact Study 2002
2002
Seite 21
You need to incorporate operational risk trackings into the project in order to assure the operational risk reduction. Observing the reduction of losses after completing the project should decide about the success of the project.
Example Derivates business Business sprozess
Trading
SLA
Operations & Services
SLA
Controlling Internal Audit
Accounting
Requirements
Requirement
Requirement
Support
Support
IT-Prozess
Front Office System
Interface
Middle-/Back Office System
2002
Support
Seite 22
2 Basic questions
Cost cutting projects usually reduce expected costs. Including unexpected costs might change the business case.
Danger of increasing unexpected costs
Volatility of Costs before project end = Cost at Risk before project end Increased Volatiltiy of Costs After the project
Process costs
Lowered expected costs after project t0 End of project

time
2002
Seite 23
Agenda
1 2 3 4 5
Quantification issues in operational risk management Prototype of an operational risk VaR calculation engine Operational Risk and Outsourcing Operational Risk and Project-/Portfolio Management Critical Success Factor
2 implications for the business
Risk management can only be successful when management level decisions are made on the basis of the numbers delivered by the risk management process
?
identify measure
(reports/ limits)
control
manage (take action)
independent auditing (are the measures adquate?)
Investment decision
2002
Seite 25

Madrid v0.2

Transféré par

Informations du document

Description originale:

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Madrid v0.2

Transféré par

Droits d'auteur :

Formats disponibles

The Management Consultants.

CHALLENGES IN THE QUANTIFICATION OF

Madrid, 14. November 2002

IBM Unternehmensberatung GmbH

The Management Consultants.

The Management Consultants.

IBM Unternehmensberatung GmbH

Create report mechanism

Develop and continuous refinement of VaR calculation models

The Management Consultants.

Supporting Data Insurance Data Scaling Factors

VaR with Insurance

VaR without Insurance Results

VaR goodness check

IBM Unternehmensberatung GmbH

IBM Unternehmensberatung GmbH

IBM Unternehmensberatung GmbH

0,5 0,4 probability 0,3 0,2 0,1 0

IBM Unternehmensberatung GmbH

The Management Consultants.

e.g. Payment Systems

e.g. Securities settlement

e.g. IT Infrastructure AMS

Examples for Outsourcing Areas of a Financial Institution

IBM Unternehmensberatung GmbH

What are Service Level Agreements

IBM Unternehmensberatung GmbH

IBM Unternehmensberatung GmbH

Risk transfer can only be achieved after a series of steps

IBM Unternehmensberatung GmbH

Identify customer requirements Identify new requirements and services

Proposal of SLAs Prepare SLAs for discusion

SLA control cycle

Monitor SLAs Levels of service are measured against agreed criteria.

Agreement with client SLAs agreed with customers

IBM Unternehmensberatung GmbH

Planning and Methodology for risk mapping workshops

Communication between lines of business

Introduction of Results of workshop into live environment

IBM Unternehmensberatung GmbH

The introduction process is classic risk managment:

IBM Unternehmensberatung GmbH

The Management Consultants.

Risk acceptance-boundary (for single risks) #

Risk estimate for an area (risk category,, business area, etc.)

IBM Unternehmensberatung GmbH

IBM Unternehmensberatung GmbH

Operations & Services

Controlling Internal Audit

Front Office System

Middle-/Back Office System

IBM Unternehmensberatung GmbH

Danger of increasing unexpected costs

Lowered expected costs after project t0 End of project

IBM Unternehmensberatung GmbH

The Management Consultants.

2 implications for the business

manage (take action)

independent auditing (are the measures adquate?)

IBM Unternehmensberatung GmbH

Vous aimerez peut-être aussi