Modelling operational risk in Banking and Insurance Palisade EMEA 2012 Risk Conference London

Transcription

1 Modelling operational risk in Banking and Insurance Palisade EMEA 2012 Risk Conference London Dr Madhu Acharyya Lecturer in Risk Management Bournemouth University 1

2 Risks in Banking and Insurance Main Banking Risks Market risk Credit risk Liquidity risk Operational risk Systemic risk Strategic risk Reputational risk Main Insurance Risks Market risk Underwriting and pricing risk Credit risk Liquidity (reserving) risks Operational risk Strategic risk Reputational risk 2

3 Business Units/lines in Banking and Insurance Banking Credit department Banking book Derivative desk Fund management Others Insurance Underwriting department Personal and commercial Claims department Reinsurance department Finance and investment department Others 3

4 Interest Rate Risk Market Risk Credit Risk. Operational risk Interest Rate Risk Market Risk Credit Risk. Operational risk Risk types Risk types Business units Credit department Business units Credit department Banking book Banking book Derivative desk Derivative desk Fund management Fund management 4

5 Expected loss and Unexpected Loss Expected loss Unexpected loss Expected loss The mean value of the probability distribution of future losses. Not a significant risk and hedged by adding a suitable spread to the interest rate charged on the loan 5

6 Unexpected Loss The true risk i.e., the risk that the loss will prove greater than originally estimated i.e., The variability of loss above the EL The EL of a diversified portfolio is simply equal to the sum of the expected losses on the individual loans in it The EL is reduced by diversifying the portfolio The volatility of the total portfolio loss is generally lower than the sum of the volatilities of the losses on individual loans (provided that the correlations amongst the individual losses are low) where represents the individual credit losses 6

7 VaR computation Probability distribution of loss data Probability = 5% Minimum $ Loss Average $ Loss Maximum $ Loss 7

8 Three methods of calculating VaR 1. Parametric (or analytical or deltanormal) method 2. Historical method 3. Monte Carlo Simulation method 8

9 Example: Computation of Value at Risk (VaR) Year Loss ($) Minimum loss $8, Maximum loss $11,

10 Mean $9, Standard deviation $ Parametric approach for the standard normal distribution, z-statistic at 95% confidence interval VaR (95%) $11,

11 VaR computation Probability distribution of loss data Probability = 5% Minimum $ Loss $0 Average $ Loss $9, $11, VaR 95% Maximum $ Loss $ size of the portfolio 11

12 Interpretation of VaR Result Given the loss data the Bank or Insurance Company (or any of its business line) can afford a loss of maximum of $11, The bank or insurance company is 95% confident that the actual loss will remain within the boundary between $0 and $11, However, there is a 5% probability that the actual loss will go beyond $11, In other words, n every 1 in 20 occasions (or days/month/year) the actual loss will go above $11, If the actual loss goes above $11, then the bank or insurance company will be insolvent. 12

13 What is operational Risk Banking sector definition In Basel II the common industry definition of operational risk is The risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but strategic and reputational risk is not included in this definition. Source: Basel Committee on Banking Supervision, Consultative Document, Operational Risk, January 2001, accessed at on 01st January,

14 Insurance sector definition The Solvency II definition of operational risk is Operational risk means the risk of loss arising from inadequate or failed internal processes, or from personnel and systems, or from external events (Article 13(29) of Level 1 text). Operational risk shall include legal risks, and exclude risks arising from strategic decisions, as well as reputation risks (Article 101 4(f)) of the Level 1 text). (Ref: CEIOPS Advice for Level 2 Implementing Measures on Solvency II: SCR Standard Formula Article III (f) Operational risk: former CP53) 14

15 Table: Detailed loss event type classification in Insurance Operational Risk by ORIC Event categories Level 1 Level 2 Level 3 1. Unauthorised used of Unauthorised activities computer system to defraud firm or customer 2. Unauthorised transactions 3. Underreported Internal fraud transactions 4. Over-reported transactions 5. Falsifying personal details Theft and fraud 1. Theft of assets 2. Destruction of assets 3. Forgery impersonation 4. Disclosure of confidential information 5. Accounting irregularities 6. Misappropriation of assets 15

16 External fraud External fraud 1. Theft of assets 2. Forgery impersonation 3. Fraudulent billing by suppliers 4. Fraudulent claims System security 1. Hacking 2. Theft of information 3. Viruses Employment practice and workplace safety Employee relations 1. Harassment 2. Terminations, including tribunals 3. Industrial activity 4. Management 5. Loss of key personnel Safe environment 1. Health and safety 2. Public liability 3. Employee liability Diversity and discrimination 1. Equal opportunities 2. Human rights 16

17 Suitability, disclosure and fiduciary 1. Regulatory impact 2. Data protection act 3. Regulatory compliance of appointed representatives 4. Customer complaints 5. Treating customers fairly Clients, products and business practices Improper business or market practices 1. Money laundering 2. Other improper market practices 3. Insider dealing 4. Tax evasion 5. Anti trust Product flaws 1. Product defects (unauthorised, etc.) 2. Product literature defects 3. Product design 4. Unintentional guarantees Selection, sponsorship, and exposure 1. Client fact-findings 2. Client exposure Advisory activities 1. Mis-selling due to mortgage endowment 2. Mis-selling (other) 17

18 Damage to physical assets Disasters and other events 1. Natural disaster losses 2. Loses from external sources (terrorism, vandalism) 3. Physical assets failure (not systems) Business disruption and system failures Systems 1. Hardware 2. Software 3. IT network 4. Telecommunication 5. Utility outage/disruption 6. External interference (excluding fraudulent activity) 18

19 Execution, delivery and process management Transaction capture, execution and maintenance 1. Customer service failure 2. Data entry error 3. Transaction system error 4. Management information error 5. Accounting error 6. Incorrect application of charges 7. Incorrect unit pricing/ allocation 8. Management failure 9. Inadequate process documentation 10. Training and competence Monitoring and reporting 1. Failed mandatory reporting 2. Inaccurate external reporting Customer intake and documentation 1. Incomplete/ incorrect application documents 2. Contract document incorrect 3. Inappropriate underwriting 4. Inappropriate reinsurance 5. Missing documentation Source: ORIC at as on 29 Dec

20 Table: Summary of Operational Loss Data (All data are hypothetical) No. of events per Month Operational Risk Categories Internal Fraud External Fraud Damage to Physical Assets Business Disruptions & System Failures No. of Month Total no. of events No. of Month Total no. of events No. of Month Total no. of events No. of Month Total no. of events Execution, Delivery & Process Management No. of Month Total no. of events k n(k) n(k) n(k) n(k) n(k) events month Average events p/m (λ)

21 Table: Summary Statistics of Frequency Loss Data Internal Fraud External Fraud Damage to Physical Assets Business Disruptio ns & System Failures Execution, Delivery & Process Managem ent Average Minimum ($) 11, , , , , Maximum ($) 199, , , , , Mean ($) 108, , , , , , Standard deviation ($) 56, , , , , ,

22 Table: Descriptive Statistics of Severity Loss Data Internal Fraud External Fraud Damage to Physical Assets Business Disruptio ns & System Failures Executio n, Delivery & Process Managem ent Averag e Minimum ($) 11, , , , , Maximum ($) 199, , , , , Mean ($) 108, , , , , ,

23 Table: Parameters of Loss Distributions from Aggregated Observed Loss Data Aggregated Operational Loss Parameters Distribution Type Frequency Mean=Variance 3.89 Poisson Severity Mean ($) 89, Pareto Standard deviation 64, ($) 23

24 Table: Parameters of Loss Distributions after Monte Carlo Simulation Aggregated Operational Loss Data Summary for Monte Carlo Simulation Frequency 4.00 Severity ($) 64, Total Aggregated 257, Operational Loss ($) 24

25 Figure: Monte Carlo Simulation Output for Internal Fraud Category 25

26 Figure: Monte Carlo Simulation Output for External Fraud Category 26

27 Figure: Monte Carlo Simulation Output for Damage to Physical Asset Category 27

28 Figure: Monte Carlo Simulation Output for Business Disruption and System Failures Category 28

29 Figure: Monte Carlo Simulation Output for Execution, Delivery and Process Management Category 29

30 Figure: Monte Carlo Simulation Output for Integrated Operational Risk 30

31 Irrational Human Behaviour Causing Operational (and Strategic) Failures Agency problem Principal-agent problem Intentional fraud Compensation culture Examples: 2007 Financial Crisis Lehman Brothers over exposure on Securitised Products Royal Bank of Scotland M&A with ABN AMRO Lloyd s Banking Group M&A with HBOS AIG exposure on CDOs Many Others 31

32 Questions and Answers 32