Advanced models for the quantification of operational risk in financial institutions under the loss distribution approach

With the regulatory spotlight on operational risk management, increasing attention has been devoted to the quantification of operational risk in recent years. The potential devastating power of operational risks has been demonstrated by many large operational losses. Some of the best known examples of major losses caused by lack of operational controls include the €5 billion loss by Société Générale in 2008, U.S.$9 billion loss of Banco National due to credit fraud in 1995, the U.S.$2.6 billionloss of Sumimoto Corporation due to unauthorized trading activity in 1996, the U.S.$1.7 billion loss and subsequent bankruptcy of Orange County due to unauthorized trading activity in 1998, the U.S.$1.3 billion trading loss causing the collapse of Barings Bank in 1995, the U.S.$0.75 billion loss of Allied Irish Bank in 2002, the loss of U.S.$2 billion by Prudential Insurance of America in 2002, and the U.S.$1.107 billion loss (fines and penalty taxes) of Yamaichi International Inc. in 1992. Both the new regulatory framework in the banking sector (Basel II) and the project for the new solvency regime in the insurance sector (Solvency II) recognize the importance of operational risk and require explicit treatment through allocations of specific capital. However, as yet there is no generally accepted definition of operational risk in the financial community. In this paper we refer to the definition proposed by the Basel Committee on Banking Supervision in 2001: “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” This definition has also been adopted for the insurance sector until now. In this categorization operational risk includes the following event types: business disruption and system failures; clients, products, and business practice; damage to physical assets; employment practice and workplace safety; execution delivery and process; external fraud; and internal fraud. In this paper, we develop a comprehensive model to quantify the capital charge necessary to cover operational risk within a financial institution. The proposed model is taken from the ‘loss distribution approach’ (LDA), which is a frequency/severity model widely used in many fields of actuarial practice. In this model the frequency and severity of loss distributions is determined for each loss event by identifying the best fitting distribution of empirical data [Moscadelli (2004), De Fontnouvelle (2003)]. We then apply copula functions to reflect the interrelationships amongst the different events dealing with operational losses [Di Clemente and Romano (2003), Reshetar (2004)]. The operational risk capital charge is estimated by quantifying the ‘value-at-risk’ (VaR) and ‘expected shortfall’ (ES) of the joint distribution of losses [Rockafellar and Uryasev (2002)], estimated using the Monte Carlo simulation. In order to better estimate the fat tails of the severity distributions, the ‘extreme value theory’ [Embrechts et al. (1997), (2003), (2004), (2005)] is also included in the model.