The Hindu Business Line : Operational Risks — The new challenge for banks

With the era of globalisation, liberalisation and deregulation of the economy, in general, and the financial and banking sector, in particular, the banking industry the world over has become more sophisticated and complex.

Risks other than of credit and market are assuming greater importance with the growing use of financial technology and the constant upgrading of the banking business profile. The factors responsible for this paradigm shift are:

Higher adoption of automated technology;

Emergence of e-commerce;

Outsourcing; and

Mergers/acquisitions/consolidations.

Operational Risk: Concept and Causes

Operational risk, as defined by the Basel Committee, is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risks. Some of the important causes of operational risk are:

Internal frauds due to employees' intentional involvement;

External frauds due mainly to robbery and forgery/falsification of documents;

Workers compensation claims, violation of employee health and safety rules;

Misuse of confidential customer information, money-laundering, sale of unauthorised and unfamiliar products;

Damage to physical assets due to terrorism, earthquakes, fires and floods;

Business disruption and system failures due to software, power or network problems

Execution errors on account of wrong data entry or incomplete legal documentation.

Difficult to quantify

It is a type of risk that is difficult to quantify because of its complexity. Though at a nascent stage, the significance of operational risk has grown over the last few years.

Unlike market and credit risks, which tend to be in specific areas of business, operational risk covers all areas. This omnipresent nature makes its proper identification, measurement and mitigation a challenging task. Worldwide, the failure of some of the big banks can be traced to improper assessment of operational risk. The effect of loss to a bank due to operational risk can be more than that of credit and market risks put together.

The fall of Barings due to the misadventure of Nick Leeson is an example of the impact of operational risk. Considering the importance and impact of operational risk to the banking system, there is an urgent need to develop good management practices that would help banks. Some of these are:

Devising a proper operational risk framework and its implementation to improve a bank's credit rating;

Reducing operational losses and, thereby, protecting and enhancing the stakeholder value; and

Increasing accountability and improving governance.

Required, a Policy Agenda

Considering these aspects, there must be a specific thrust towards an Operational Risk Management Department in a bank. Its key responsibilities would be:

Identification of key risk indicators;

Self assessment;

Verification of systems and procedures;

Setting up of Business Continuity Plan (BCP)/Disaster Management (DM); and

Maintaining loss database.

The proper identification of different types of key risk indicators (KRI) pertaining to different business areas of the bank is the need of the hour. These indicators need to be reviewed periodically (monthly or quarterly) to alert banks to the changes that may be indicative of risk concerns.

To control these risks, banks can put a trigger in each KRI, which would act as an early warning signal. Along with the risk trigger, proper testing and verification of all systems and procedures would help the bank identify leakages, which could be a major source for systemic or non-systemic revenue losses.

Thus, the main duty of an operational risk manager is to scrutinise the new product and services of a bank from the operational risk perspective.

Against the backdrop of various external shocks the country has faced in the recent past, to mitigate the operational risk at the optimum level, Business Continuity Plan (BCP) and Disaster Management (DM) practices play a crucial role. A well-developed BCP minimises the duration of business disruption and system failure time and, thereby, helps the bank maintain its smooth day-to-day business. As regards maintaining historical loss database, tracking of good quality data from reliable and authentic sources in the different categories, as prescribed by Basel-II, is an important criterion to migrate the Advanced Management Approach (AMA). This will give banks the freedom to calculate their value at risk (VaR) in each business and allocate regulatory capital accordingly.

Basel-II Implementation

Basel-II has outlined three approaches — Basic Indicator Approach, Standardised Approach and Advanced Management Approach. The Basic Indicator Approach, which is the simplest, requires the bank's average annual gross income over the previous three years to be multiplied by a factor (15 per cent for India) to determine the capital requirement for operational risk.

The Standardised Approach goes a step further and separates the income streams into eight business-lines. However, under the Advanced Management Approaches (AMA), a bank can use its own method to assess its exposure to operational risk. But to migrate to AMA, a bank must satisfy some strict qualitative and quantitative standards set by the regulator. Some of the important criteria are

Well-developed and well-documented risk management systems fully integrated into the day-to-day risk management process of the bank;

A system of regular reporting of operational risk exposures and loss experience to business unit management and the board of directors;

Maintaining rigorous procedures for operational risk model development and independent model validation;

Capability to track loss data, to each business line, and access external data bases of loss incidents where appropriate internal data are not available.

Under AMA, one of the bank's primary goals of operational risk management is to minimise regulatory capital requirement. To achieve this, banks need to develop sophisticated risk models whose reliability lies on the degree of predictability of future loss, based on the quality of historical loss data and proper identification of loss distribution function in each business area.

To migrate successfully to AMA, India's banks would require a few more years. They would need to focus on the development of a sound operational risk management system, maintenance of reliable and authentic loss database both from the internal and external sources and, lastly, develop loss distribution models.

In terms of risk category, the loss distribution function of a typical bank broadly reveals two shapes: One for high frequency, low severity losses and the other for low frequency, high severity losses. The former is common and can be predicted with a fair degree of accuracy. However, to predict the second category of loss event with a certain degree of probability is a great challenge to the banks and, therefore, it is essential to have access first to proper continuous distribution function. Only then would it be possible to predict the future losses based on the loss distribution model.

The successful implementation of these steps would not only mitigate the risk of probable future losses, but also help banks maintain minimum regulatory capital under operational risk.

(The author is Assistant General Manager, Risk Management Department, IDBI. The views are personal and do not reflect that of the organisation he belongs to.)