The Hindu Business Line : Operational risk capital in banks: Migrating to advanced measurement approach

A good operational risk model is one which not only captures all the granularity of bank operations, but also most of the extreme loss situations with proper probability distribution.

Subhasish Roy

Operational risk has always been an important component of risk faced by banks, but a widespread movement to isolate this began only a few years back with a plan by the Basel Committee on Banking Supervision to include specific capital allocation for operational risk in its updated Basel Capital Accord, commonly referred to as Basel II.

As per Basel II, operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.

Risk Capital

The Basel Committee has put forward a framework consisting of three options for estimating operational risk capital charges in a continuum of increasing sophistication and risk sensitivity. These are: i) basic indicator approach; ii) standardised approach; and iii) advanced measurement approach. These three methods range from an approach that assigns a single capital charge to the entire business of the bank to one that charges capital by business line, with an opportunity for significant input from the bank.

In the first two approaches, the regulatory capital is not properly aligned with the risks associated with a bank. As the risk capital is not allocated according to the actual risk profile of the bank under the basic indicator and standardised approaches, this may not induce much incentive to the banks to improve their risk management system.

As per these two approaches, a large bank having a good operational risk management system may end up allocating higher amount of regulatory risk capital, whereas a smaller bank with a poor operational risk management system may allocate very less risk capital. The advanced measurement approach (AMA) gives an incentive to banks to hold a lower capital charge, as banks have the option to allocate lesser amount of capital based on their actual risk profile, where risk capital can be estimated on the basis of Value at Risk (VaR) results.

VaR represents the total estimated loss that a bank can incur on a particular day with a certain probability for a certain period of time.

Moving towards AMA

As AMA gives the bank the freedom to choose its economic capital, which could be low compared to regulatory capital, the bank in its own interest must develop a sound risk-management system with a sophisticated operational risk model to migrate to AMA in the shortest possible time. However, one of the biggest challenges in migrating to AMA is developing a quality loss database.

Though actual historical loss data is one of the important parameters for estimation of risk capital, the identification, tracking and storing of all historical loss data of the bank, business line-wise is a difficult task. Specifically, banks may capture loss data of internal fraud, external fraud, damage of physical assets, etc., but loss data pertaining to business disruption and system failure or loss data relating to wrong data entry or product flaws are very difficult to quantify.

For example, the degree of operational loss (if customer claims arise against the bank on account of business disruption) on account of business disruption/system failure in a branch of high business potential varies widely from that of a branch located in rural areas. The degree of operational loss varies even from peak business hours to after banking hours in a branch.

To estimate these losses, banks first have to classify their branches in terms of business potential. Incidence of business disruption in a branch needs to be further classified in term of normal business hours, peak business hours and after business hours. Regarding capturing loss data on account of wrong entry, banks have to identify the reason for wrong entry by the employee, that is, whether it is due to lack of job knowledge or some mala fide interest. Both need to be captured separately, as the risk mitigation strategies will be different.

Latest study reveals that in all types of analytical interpretation, 80 per cent of the problems is data related and only 20 per cent mathematical, that is, framing an appropriate scientific model to measure the risk. Thus, if quality data is not available quantitative analysis would be erroneous even if the best scientific model is used.

A good operational risk model is one which not only captures all the granularity of the operations of the bank, but also most of the extreme loss situations with proper probability distribution. To frame this sophisticated model, one needs to incorporate all the probable loss events based on quantitative (internal and external data) as well as qualitative findings, so that most of the unexpected losses of the bank can be estimated through VaR.

As the nature and degree of operational risk varies from bank to bank, the development of a comprehensive operational risk model is not only a science but also an art.

After developing the model, the next step is using of loss data in the model. While using such data, one has to keep in mind that if a bank does not have sufficient internal loss database under each business line, it may collect data from external sources to substitute the data gap, which will enable it to develop a sound operational risk model based on its own loss distribution function.

But directly combining internal and external data violates one of the fundamental precepts of operational risk modelling because loss data has meaning only in the context of the distribution from which it is drawn. Thus, before substituting external loss data for internal loss database, a bank must test that the loss distribution function from two different sources matches properly.

The lack of sufficient internal loss database and the problem involved in mixing such data with external loss data has given risk managers in banks the option to develop another alternative called “scenario-based approach”, where the experts in the bank will estimate their own set of probable scenarios with a discrete number of frequencies and severities of losses to be attached to each scenario.

The purpose of building such scenarios is to develop a risk model to estimate risk capital, where each scenario will act as a dummy variable for real loss data. However, the success of such model purely depends upon the actual prediction of the future loss scenarios. Thus, it is desirable that banks use this approach where they the expertise to predict such scenarios with some reasonable degree of accuracy.

Key objectives

Risk capital under AMA of Basel II has two objectives. First, to provide a second line of defence to systems and controls, that is, a buffer for unexpected losses. And the second is to encourage banks to invest in better risk management systems and, thereby, develop a cost effective control mechanism. But whatever sophisticated operational risk model banks use to estimate their risk capital, they are not absolutely free from all types of unexpected losses, specifically in the case of abnormal losses of catastrophic nature.

Thus, as a precautionary measure, to protect its own interest, banks should periodically review the gap between the existing insurance policy with future insurance requirements for all the critical areas of business and fill the gap wherever possible, as insurance acts as contingent capital.

(The author is Assistant General Manager, Risk Department, IDBI Bank.)