Operational Risk Management: Added Value of Advanced Methodologies

Operational Risk Management: Added Value of Advanced Methodologies Paris, September 2013 Bertrand HASSANI Head of Major Risks Management & Scenario Analysis Disclaimer: The opinions, ideas and approaches expressed or presented are those of the author and do not necessarily reflect Santander s position. As a result, Santander cannot be held responsible for them. The values presented are just illustrations and do not represent Santander losses. Copyright: ALL RIGHTS RESERVED. This presentation contains material protected under International Copyright Laws and Treaties. Any unauthorized reprint or use of this material is prohibited. No part of this presentation may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system without express written permission from the author. Santander UK

Key statements 2 1. Risk management moto: Si Vis Pacem Para Belum 1. Awareness 2. Prevention 3. Control 4. Mitigation 2. A risk is not a loss. 1. It may never crystallise 2. The caracteristics are assumptions 3. Modelling is not the truth 1. Exactly replicating the univers with math is Utopia 2. A model defines itself by its limitations.

Basel Definition 3 Operational Risks (BIS definition): It s «the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.» However, the Basel Commitee recognizes that operational risk is a term that has a variety of meanings and therefore banks are allowed to implement specific and internal definition of operational risk. The Basel II definition of operational risk clearly excludes strategic risk and reputational risk.

Basel Implications 4 Basel II-III / Solvency II uses a "three pillars" definition. The first pillar minimum capital requirements (addressing risk) basic indicator approach or BIA, standardized approach or TSA, advanced measurement approach or AMA. The second pillar (supervisory review ) The second pillar deals with the regulatory response to the first pillar : the tools, including Backtesting etc. And the framework for dealing with all the other risks a bank may face. The third pillar (market discipline ) The third pillar greatly increases the disclosures that the bank must make.

Framework 5

6 Part 1: Data Analysis

Analysing the data: Internal Taxonomy 7 1. Basel Matrix Vs Internal Taxonomy 2. Cross Distributions

Analysing the data: Statistical Analysis 8 1. Statistical Moments 2. Stationarity (Ergodicity)

Analysing the data: Internal Vs External Data 9

Analysing the data: Autocorrelation 10

Scenario Development Process 11 Scenario Process Scenario Development Operational Risk Control workshop to select initial scenarios Submission to the business owners who are entitled to amend them if they are not representative. Values 1:10 1:40 Evaluation by the business owners Scenario process & output Challenge of the Values Required output Description Sign-offs The type of severe event / scenario that could occur a few times in your career. Expected about once every 10 years in the bank (Juglar Cycle) The type of severe event / scenario that could occur in your career. Expected about once every 40 years in the bank (Kondratiev Cycle) A set of scenarios have been developed for each of the 17 Model Risk Categories. The scenario development process involves the following steps: Pre-interview preparation - briefing notes and calls to scenario participants, internal and external loss exhibits, risk assessment information, etc. Selection of workshop participants Business owners invite relevant business and risk experts for each of the interviews Scenario Assessment Workshop Key stakeholders meeting to finalise scenario descriptions & values across all categories. Challenge the values On three basis Consistency check Conservativeness Integrity Finalisation & Sign-off Agree and document the final descriptions and values 11

12 Part 2: Capital Modelling

The Loss Distribution Approach 13 DATA : Frequency : - Incident Dates Calibration Frequency distribution Probability Discret distribution: Poisson, Binomial, etc. Quantity Monte Carlo Simulation, FFT, Panjer Probability Loss Distribution CR Probability Severity : - Incident Amounts Severity distribution Amount 99,9% Quantile Continous distribution: Lognormal, GPD, Gumbel etc. Amounts VaR

Scenario Based Approach: EVT 14 All the participants are required to provide their quotation on these extreme incidents with regard to their business area/unit, without any cooperation. Then based on the Fisher-Tippet theorem, a generalized extreme value distribution is fitted on these values and the theoretical statistics obtained (mean, median, etc.) are compared to those obtained from the consensus. Depending on the outcome a more or less large confidence interval will be built around the consensus. Mathematical Assumptions The Fisher-Tippet theorem (Fisher and Tippett (1928), Gnedenko (1943)) states that under regular conditions the distribution ofha ε sequence of maxima converges asymptotically to a GEV distribution, whose density is equal to, x u 1 + ε > 0 1 x u h( x; u, β, ε ) = 1 + ε β β 1 x u ε 1+ ε β +* For β, where u R is the location parameter β R is the scale parameter and ε R is the shape parameter. This distribution contains the Fréchet ( ε > 0), the Weibull ( ε = 0) and the Gumbel Distributions ( ε < 0). 1 1 ε e

Scenario Based Approach: Bayesian Networks (Ben-Gal I., Bayesian Networks, in Ruggeri F., Faltin F. & Kenett R., Encyclopedia of Statistics in Quality & Reliability, Wiley & Sons (2007).) 15 Based on Bayes Theorem for Conditional Probabilities DPA (C) EF (S) EDPM (W) BDSF (B) Loss (A)

Data Based Approach: How can we find the appropriate distribution? (1/2) 16 We focus on the severities and try to fit some Distributions. More than 200 simulations 3 goodness-of-fit tests (Kolmogorov-Smirnov, Anderson-Darling, Cramer-Von-Mises): The Lognormal distribution is rejected in 82% of the cases. The Weibull distribution is rejected in 86.5% of the cases. The Exponential distribution is rejected in 100% of the cases One could try Gamma, Gumbel, Beta, Pareto, Burr, Alpha-Stabe etc. until he finds a good one, if there is.

Data Based Approach: How can we find the appropriate distribution? (2/2) 17 Historical Quantiles > Lognormal Quantiles

Data Based Approach: Left Truncated Distributions 18 Expectation-Maximization algorithm f ( x X u) Constrained Maximum Likelihood (BFGS, Nelder-Mead etc.) ( x; X < u) ( X < u) f < = I, where I < P { x< u} { x u} 1if x < u = 0 if x u

Data Based Approach: Right Truncated Distributions 19 Hypothesis: ( ) ( ) > = n p n f * x x 0 g x ( ) = pn f g x n = 1 n = 1 The small losses and the large ones follow different distributions p 0 x = 0 Lognormal distribution to model the central part (below the threshold). ( ) ( ) > = n p n f * x x 0 g x Extreme Value Theory: Pickands n = 1 theorem (1973), above a sufficiently high threshold «u», the data follows a p0 x = 0 Generalized Pareto Distribution: ( x) P( X u x X > u ) The severity distribution: The Peak-over-Threshold method (POT) ( u + x) F ( u ) 1 F ( u ) F F u = = F ~ > GPD ( u, β = scale, ξ = p 0 * n ( x) x > 0 x = 0 shape ) f Global ( x)= w f body + (1 w) f tail Where, w = P( x < u)

Data Based Approach: POT - Threshold Estimation 20 1. Shape parameter estimation based on order statistics (Hill plot and its turning point) Thre sho ld 7 0 0 0.0 0 2 0 3 0.0 0 8 5 0.0 0 3 9 7.0 0 2 9 8.0 0 2 5 0.0 0 1 9 6.0 0 1 9 0.0 0 1 5 1.0 0 1 3 6.0 0 1 1 9.0 0 9 7.5 0 9 7.5 0 9 7.5 0 8 7.8 0 7 7.7 0 6 8.1 0 6 6.0 0 xi (CI, p =0.95) 0.5 1.0 1.5 2.0 2.5 3.0 3.5 1 5 2 7 3 9 5 1 6 3 7 5 8 7 9 9 1 1 2 1 2 7 1 4 2 1 5 7 1 7 2 1 8 7 2 0 2 2 1 7 2 3 2 2 4 7 2 6 2 2 7 7 2 9 2 3 0 7 3 2 2 3 3 7 3 5 2 3 6 7 3 8 2 3 9 7 4 1 2 Order S tatistics

Data Based Approach: POT - Illustration 21

22 Combining Data and Scenarios: Credibility Theory (P.V. Shevchenko (2011). Modelling Operational Risk using Bayesian Inference, Springer, Berlin. ) The strategy involves the following: Selection of the distribution characterizing the risk category Estimation of the parameters using the scenarios on a standalone basis Estimation of the parameters using the Internal Loss data only Valuation of the weights building a non-parametric distribution built implementing a bootstrap/ jackknife approach. Loss Distribution built using a Monte Carlo Simulation Non Parametric Distribution of the Parameters Frequency 0 100 200 300 400 8.40 8.45 8.50 8.55 Parameters 22

Combining Data and Scenarios: Penalised Maximum Likelihood 23 Two steps approach: Maximum Likelihood estimation on the internal data Ordinary Least Square considering the quantile generated using the distribution parameterised and those obtained from the scenarios Internal data percentage obtained using External Data Q-Q plot Sample Quantiles -2 0 2 4-3 -2-1 0 1 2 3 Theoretical Quantiles 23

24 Combining Data and Scenarios: Cascade Bayesian Approach (The Cascade Bayesian Approach for a controlled integration of internal data, external data and scenarios Hassani B., Renaudin A., 2013) Procedure Prior Fitted on Scenario Updated with External Data First Posterior distribution used as Prior Final Posterior distribution Updated with Internal Data Θ* We use the scenarios as a starting point to inform the prior (i.e. distribution of the parameters) and the joint prior. Then we update the joint prior by using the external data (to be consistent, we only use the losses above the 1:10 scenario) which provides us the posterior distribution. This first posterior distribution is then used a prior for a second Bayesian Inference Approach. These are updated using the internal data to obtain a second posterior distribution, from which we are able to derive the optimal parameters of the statistical distribution assumed. Depending on the assumption: we have conjugate priors, i.e. no numerical algorithm is necessary to obtain the posterior distribution (lognormal approach), we do not have conjugate priors, we need a MCMC method to obtain the posterior distribution. 24

Toward a multivariate distribution to simulate the contagion 25 Elliptic Copula f 1 f 2 f 3 f 4 f 5 f 6 f 7 f 8 f 9 f 10 f 1 1 0.26-0.37 0.24 0 0.64-0.41-0.11 0.52 0.41 f 2 0.26 1 0.22 0.21-0.34-0.15 0.71 0.24 0.1 0.05 f 3-0.37 0.22 1 0.21 0.19 0.03-0.41-0.04 0.52 0.36 f 4 0.24 0.21 0.21 1-0.68 0.11 0.36-0.41 0.01-0.47 f 5 0-0.34 0.19-0.68 1 0.24 0.21-0.21 0.36-0.41 f 6 0.64-0.15 0.03 0.11 0.24 1-0.05-0.21-0.34 0.02 f 7-0.41 0.71-0.41 0.36 0.21-0.05 1 0.14 0.52-0.16 f 8-0.11 0.24-0.04-0.41-0.21-0.21 0.14 1-0.03-0.25 f 9 0.52 0.1 0.52 0.01 0.36-0.34 0.52-0.03 1 0.14 f 10 0.41 0.05 0.36-0.47-0.41 0.02-0.16-0.25 0.14 1 Vine Archtiecture A copula function enables creating a multivariate distribution including the various marginal risk distributions. However, elliptic copulas allowing an easier calibration fail capturing asymmetric shocks while extreme values or archimedean copulas permitting the capture of upper tail dependences may be quite difficult to parameterize.

Nested Structures 26 Fully nested copulas in a 4-dimensional case: the initial level is composed by univariate distributions, the second level presents the copula considering one-dimensional marginals, the third level is built with a copula considering bivariate marginals and a univariate distribution, and so on. Partially nested copula in a 4-dimensional case: the initial level is composed of univariate distributions representing each Basel category for instance, the second level represents the bivariate copulas linking these margins and the third level corresponds to the copula linking the two previous ones.

Vines Structures 27 Pair-copula architectures: suggested by Joe (1996), developed successively by Bedford and Cooke (2001; 2002), Kurowicka and Cooke (2004) and Guégan and Maugis (2010), are more flexible: any class of copula can be used (elliptical, Archimedean or extreme-value for instance), and no restriction is required on the parameters. Nevertheless, compared to nested structures, vine copulas require testing and estimating a large quantity of copulas. Pair-copula architectures: Let X = [X 1,X 2,...,X n ] be a vector of random variables, with joint distribution F and marginal distributions F 1, F 2,..., F n : Sklar (1959) theorem insures the existence of a function mapping the individual distributions to the joint one. f denotes the density function associated to the distribution F, then a vine decomposition may be written:

A Risk Management & Measurement Framework 28 Univariate Approach Expected Loss Budget Tolerance Regulatory Capital Economic Capital Reverse Stress-Testing f 1 Multivariate Approach ( f ) M C f, θ 1, K n Bank Resilience f n

29 Part 3: Next Steps

Next Steps 30 Applying

Next Steps 31 The table presents the parameters of the distributions fitted on either the i.i.d. losses or the residuals characterising the CPBP / Retail Banking weekly aggregated. Traditional LDF denotes Frequency Severity, Time Series LDF characterises the second approach considering i.i.d. weekly losses, AR denotes the autoregressive process and both ARFI and Gegenbauer denote their related processes. The standard deviations are provided in brackets. The Goodness-of-Fit (GoF) is considered to be satisfactory if the value is > 5%. If it is not, then the distribution associated to the largest p-value is retained. The best fit per column are presented in bold characters. Note: NA denotes a model "Not Applicable", and OD denotes results which may be provided "On Demand".

Next Steps: Characterisation of the crisis 32 High Correlations Defaults No Liquidity Problem of Capital Contagion Effects Systemic Risk: What Defaults Are Telling Us Kay Giesecke and Baeho Kim Stanford University March 7, 2010